Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:file.exe
Analysis ID:1585286
MD5:f54491fdb13ecab8b06510f1c8431032
SHA1:2e42f6e1a1a559a6ea6dbb974f68d3f598e568fc
SHA256:40adba8fc61052a26baeb280f4645287ce1390e81ba42ff57b746f71b1c9f623
Tags:exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Attempt to bypass Chrome Application-Bound Encryption
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Amadey
Yara detected Amadeys Clipper DLL
Yara detected Amadeys stealer DLL
Yara detected LummaC Stealer
Yara detected PureLog Stealer
Yara detected Stealc
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains very large array initializations
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Creates multiple autostart registry keys
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender Tamper protection
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found many strings related to Crypto-Wallets (likely being stolen)
Found pyInstaller with non standard icon
Hides threads from debuggers
Injects a PE file into a foreign processes
LummaC encrypted strings found
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies windows update settings
Monitors registry run keys for changes
PE file contains section with special chars
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Sigma detected: New RUN Key Pointing to Suspicious Folder
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks for debuggers (devices)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to record screenshots
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Installs a global mouse hook
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for user specific document files
Shows file infection / information gathering behavior (enumerates multiple directory for files)
Sigma detected: Browser Started with Remote Debugging
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Execution of Suspicious File Type Extension
Spawns drivers
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Yara detected Credential Stealer

Classification

Process Tree

  • System is w10x64
  • file.exe (PID: 7592 cmdline: "C:\Users\user\Desktop\file.exe" MD5: F54491FDB13ECAB8B06510F1C8431032)
    • skotes.exe (PID: 5796 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: F54491FDB13ECAB8B06510F1C8431032)
  • skotes.exe (PID: 5932 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: F54491FDB13ECAB8B06510F1C8431032)
  • skotes.exe (PID: 2288 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: F54491FDB13ECAB8B06510F1C8431032)
    • c061393b55.exe (PID: 3916 cmdline: "C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe" MD5: CB538563778A18D571E87AD75705668E)
      • c061393b55.exe (PID: 4772 cmdline: "C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe" MD5: CB538563778A18D571E87AD75705668E)
        • WerFault.exe (PID: 7872 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1704 -ip 1704 MD5: C31336C1EFC2CCB44B4326EA793040F2)
        • cmd.exe (PID: 7592 cmdline: C:\Windows\system32\cmd.exe /c "dxdiag /t C:\Users\user\AppData\Local\Bunny\Info.txt" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
          • conhost.exe (PID: 1668 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • dxdiag.exe (PID: 1988 cmdline: dxdiag /t C:\Users\user\AppData\Local\Bunny\Info.txt MD5: 19AB5AD061BF013EBD012D0682DF37E5)
        • taskkill.exe (PID: 4576 cmdline: taskkill /F /IM chrome.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)
          • conhost.exe (PID: 2632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • chrome.exe (PID: 6040 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9876 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
          • chrome.exe (PID: 4776 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2012 --field-trial-handle=2008,i,17564928535210738890,5689791328347770168,262144 /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
        • taskkill.exe (PID: 7872 cmdline: taskkill /F /IM chrome.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)
          • conhost.exe (PID: 2380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • chrome.exe (PID: 5924 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9876 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
          • chrome.exe (PID: 6892 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=1976 --field-trial-handle=1956,i,11737153874150669047,12636588976470451220,262144 /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
    • db0740f8e4.exe (PID: 1704 cmdline: "C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exe" MD5: 6446A00EB59754E15749AF229B0D5217)
      • conhost.exe (PID: 7560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • db0740f8e4.exe (PID: 5816 cmdline: "C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exe" MD5: 6446A00EB59754E15749AF229B0D5217)
      • WerFault.exe (PID: 7944 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 908 MD5: C31336C1EFC2CCB44B4326EA793040F2)
    • e0ac53ba53.exe (PID: 6660 cmdline: "C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exe" MD5: 37E85A34D4EC7C387A79E20CE262F2CF)
    • cf4bd6029c.exe (PID: 5516 cmdline: "C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exe" MD5: 612B785A52C7C281DD891D4835E0E4CE)
    • 05c06146f2.exe (PID: 800 cmdline: "C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe" MD5: 8E7317BD5F12DA95C46CA94572B2C331)
      • chrome.exe (PID: 3476 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)
      • msedge.exe (PID: 4036 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 69222B8101B0601CC6663F8381E7E00F)
    • 959ae18948.exe (PID: 5752 cmdline: "C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exe" MD5: A5F4B776FBC130947C7EA91252E30747)
      • taskkill.exe (PID: 5356 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
        • conhost.exe (PID: 6424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • taskkill.exe (PID: 2348 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
        • conhost.exe (PID: 1968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • taskkill.exe (PID: 6972 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
        • conhost.exe (PID: 1360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • taskkill.exe (PID: 6724 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
        • conhost.exe (PID: 180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • taskkill.exe (PID: 4536 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
        • conhost.exe (PID: 7148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • firefox.exe (PID: 2780 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
      • taskkill.exe (PID: 2636 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
        • conhost.exe (PID: 7132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • caf9f1bef3.exe (PID: 5264 cmdline: "C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exe" MD5: CB31FF98156630BF835768E1C1B47EE1)
    • b3206cdf20.exe (PID: 6616 cmdline: "C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe" MD5: B87ABAE5DCF781D2DD96D6C8FBBDE6FF)
    • 8c9c7a39f7.exe (PID: 1624 cmdline: "C:\Users\user\AppData\Local\Temp\1033699001\8c9c7a39f7.exe" MD5: 1C0FDE14F7A46816A2E8A747A90E1584)
  • mstee.sys (PID: 4 cmdline: MD5: 244C73253E165582DDC43AF4467D23DF)
  • mskssrv.sys (PID: 4 cmdline: MD5: 26854C1F5500455757BC00365CEF9483)
  • cf4bd6029c.exe (PID: 6348 cmdline: "C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exe" MD5: 612B785A52C7C281DD891D4835E0E4CE)
  • firefox.exe (PID: 7200 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
    • firefox.exe (PID: 7252 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
      • firefox.exe (PID: 2340 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2292 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2204 -prefsLen 25358 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f00215ad-1a9f-4dfa-990d-aaf96e354c4f} 7252 "\\.\pipe\gecko-crash-server-pipe.7252" 1a1d166eb10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • 05c06146f2.exe (PID: 7588 cmdline: "C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe" MD5: 8E7317BD5F12DA95C46CA94572B2C331)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Lumma Stealer, LummaC2 StealerLumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.lumma
NameDescriptionAttributionBlogpost URLsLink
AmadeyAmadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.amadey
NameDescriptionAttributionBlogpost URLsLink
StealcStealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: LummaC

{"C2 url": ["framekgirus.shop", "abruptyopsn.shop", "pancakedipyps.click", "wholersorie.shop", "tirepublicerj.shop", "noisycuttej.shop", "cloudewahsj.shop", "rabidcowse.shop", "nearycrepso.shop"], "Build id": "FATE99--test"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[5].exeJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[3].exeJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[3].exeJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
        C:\Users\user\AppData\Local\Temp\1033700001\24a1c81f44.exeJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
          C:\Users\user\AppData\Local\Temp\1033706001\4e6501ac3b.exeJoeSecurity_PureLogStealerYara detected PureLog StealerJoe Security
            Click to see the 3 entries

            Memory Dumps

            SourceRuleDescriptionAuthorStrings
            00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
              00000016.00000003.2299818266.0000000001418000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
                00000016.00000003.2299582589.0000000001464000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
                  00000032.00000003.2429756005.0000000004D80000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_StealcYara detected StealcJoe Security
                    00000015.00000003.2211666253.0000000001253000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
                      Click to see the 11 entries

                      Unpacked PEs

                      SourceRuleDescriptionAuthorStrings
                      2.2.skotes.exe.650000.0.unpackJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
                        3.2.skotes.exe.650000.0.unpackJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
                          1.2.file.exe.5d0000.0.unpackJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security

                            Sigma Signatures

                            System Summary

                            barindex
                            Sigma detected: New RUN Key Pointing to Suspicious Folder
                            Source: Registry Key setAuthor: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 2288, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cf4bd6029c.exe
                            Sigma detected: Browser Started with Remote Debugging
                            Source: Process startedAuthor: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe, ParentProcessId: 800, ParentProcessName: 05c06146f2.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 3476, ProcessName: chrome.exe
                            Sigma detected: CurrentVersion Autorun Keys Modification
                            Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 2288, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cf4bd6029c.exe
                            Sigma detected: Execution of Suspicious File Type Extension
                            Source: Process startedAuthor: Max Altgelt (Nextron Systems): Data: Command: , CommandLine: , CommandLine|base64offset|contains: , Image: C:\Windows\System32\drivers\mstee.sys, NewProcessName: C:\Windows\System32\drivers\mstee.sys, OriginalFileName: C:\Windows\System32\drivers\mstee.sys, ParentCommandLine: , ParentImage: , ParentProcessId: -1, ProcessCommandLine: , ProcessId: 4, ProcessName: mstee.sys

                            Suricata Signatures

                            ⊘No Suricata rule has matched

                            Joe Sandbox Signatures

                            Click to jump to signature section

                            Show All Signature Results

                            AV Detection

                            barindex
                            Antivirus / Scanner detection for submitted sample
                            Source: file.exeAvira: detected
                            Antivirus detection for URL or domain
                            Source: https://sputnik-1985.com/apidP.aAvira URL Cloud: Label: malware
                            Source: https://sputnik-1985.com/apisYEAvira URL Cloud: Label: malware
                            Source: https://sputnik-1985.com/=kAvira URL Cloud: Label: malware
                            Source: https://sputnik-1985.com:443/apibeAvira URL Cloud: Label: malware
                            Source: https://steamcommunity.coAvira URL Cloud: Label: phishing
                            Source: https://sputnik-1985.com/apiu(Avira URL Cloud: Label: malware
                            Source: https://sputnik-1985.com:443/apiAvira URL Cloud: Label: malware
                            Source: https://sputnik-1985.com/apiGAvira URL Cloud: Label: malware
                            Source: https://sputnik-1985.com/DAvira URL Cloud: Label: malware
                            Source: https://sputnik-1985.com/apiSAvira URL Cloud: Label: malware
                            Source: https://sputnik-1985.com/lAvira URL Cloud: Label: malware
                            Antivirus detection for dropped file
                            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[2].exeAvira: detection malicious, Label: TR/ATRAPS.Gen
                            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[1].exeAvira: detection malicious, Label: TR/ATRAPS.Gen
                            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[2].exeAvira: detection malicious, Label: HEUR/AGEN.1320706
                            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[1].exeAvira: detection malicious, Label: TR/Crypt.TPM.Gen
                            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[3].exeAvira: detection malicious, Label: TR/Crypt.TPM.Gen
                            Found malware configuration
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpMalware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
                            Source: 13.2.db0740f8e4.exe.400000.0.raw.unpackMalware Configuration Extractor: LummaC {"C2 url": ["framekgirus.shop", "abruptyopsn.shop", "pancakedipyps.click", "wholersorie.shop", "tirepublicerj.shop", "noisycuttej.shop", "cloudewahsj.shop", "rabidcowse.shop", "nearycrepso.shop"], "Build id": "FATE99--test"}
                            Multi AV Scanner detection for dropped file
                            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[4].exeReversingLabs: Detection: 55%
                            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[1].exeReversingLabs: Detection: 50%
                            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[3].exeReversingLabs: Detection: 44%
                            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[5].exeReversingLabs: Detection: 21%
                            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ONMZACOW\random[3].exeReversingLabs: Detection: 52%
                            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[1].exeReversingLabs: Detection: 47%
                            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[3].exeReversingLabs: Detection: 36%
                            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[4].exeReversingLabs: Detection: 39%
                            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[5].exeReversingLabs: Detection: 83%
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeReversingLabs: Detection: 47%
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeReversingLabs: Detection: 50%
                            Source: C:\Users\user\AppData\Local\Temp\1033699001\8c9c7a39f7.exeReversingLabs: Detection: 36%
                            Source: C:\Users\user\AppData\Local\Temp\1033700001\24a1c81f44.exeReversingLabs: Detection: 44%
                            Source: C:\Users\user\AppData\Local\Temp\1033702001\31f59e2a09.exeReversingLabs: Detection: 39%
                            Source: C:\Users\user\AppData\Local\Temp\1033704001\a85084d20f.exeReversingLabs: Detection: 52%
                            Source: C:\Users\user\AppData\Local\Temp\1033705001\54d18f4f90.exeReversingLabs: Detection: 55%
                            Source: C:\Users\user\AppData\Local\Temp\1033706001\4e6501ac3b.exeReversingLabs: Detection: 83%
                            Source: C:\Users\user\AppData\Local\Temp\1033707001\a0d135de95.exeReversingLabs: Detection: 21%
                            Source: C:\Users\user\AppData\Local\Temp\ITH3569MCVRCZNYE5XQ77V.exeReversingLabs: Detection: 57%
                            Multi AV Scanner detection for submitted file
                            Source: file.exeVirustotal: Detection: 58%Perma Link
                            Source: file.exeReversingLabs: Detection: 57%
                            AI detected suspicious sample
                            Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.8% probability
                            Machine Learning detection for dropped file
                            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[2].exeJoe Sandbox ML: detected
                            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[1].exeJoe Sandbox ML: detected
                            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[2].exeJoe Sandbox ML: detected
                            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[1].exeJoe Sandbox ML: detected
                            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[3].exeJoe Sandbox ML: detected
                            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[3].exeJoe Sandbox ML: detected
                            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[4].exeJoe Sandbox ML: detected
                            Machine Learning detection for sample
                            Source: file.exeJoe Sandbox ML: detected
                            Sample uses string decryption to hide its real strings
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: 185.215.113.43
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: /Zu7JuNko/index.php
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: S-%lu-
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: abc3bc1985
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: skotes.exe
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: Startup
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: cmd /C RMDIR /s/q
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: rundll32
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: Programs
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: %USERPROFILE%
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: cred.dll|clip.dll|
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: cred.dll
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: clip.dll
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: http://
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: https://
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: /quiet
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: /Plugins/
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: &unit=
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: shell32.dll
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: kernel32.dll
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: GetNativeSystemInfo
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: ProgramData\
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: AVAST Software
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: Kaspersky Lab
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: Panda Security
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: Doctor Web
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: 360TotalSecurity
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: Bitdefender
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: Norton
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: Sophos
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: Comodo
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: WinDefender
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: 0123456789
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: Content-Type: multipart/form-data; boundary=----
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: ------
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: ?scr=1
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: Content-Type: application/x-www-form-urlencoded
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: ComputerName
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: -unicode-
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: VideoID
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: DefaultSettings.XResolution
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: DefaultSettings.YResolution
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: ProductName
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: CurrentBuild
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: rundll32.exe
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: "taskkill /f /im "
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: " && timeout 1 && del
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: && Exit"
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: " && ren
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: Powershell.exe
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: -executionpolicy remotesigned -File "
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: shutdown -s -t 0
                            Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmpString decryptor: random
                            Source: 13.2.db0740f8e4.exe.400000.0.raw.unpackString decryptor: cloudewahsj.shop
                            Source: 13.2.db0740f8e4.exe.400000.0.raw.unpackString decryptor: rabidcowse.shop
                            Source: 13.2.db0740f8e4.exe.400000.0.raw.unpackString decryptor: noisycuttej.shop
                            Source: 13.2.db0740f8e4.exe.400000.0.raw.unpackString decryptor: tirepublicerj.shop
                            Source: 13.2.db0740f8e4.exe.400000.0.raw.unpackString decryptor: framekgirus.shop
                            Source: 13.2.db0740f8e4.exe.400000.0.raw.unpackString decryptor: wholersorie.shop
                            Source: 13.2.db0740f8e4.exe.400000.0.raw.unpackString decryptor: abruptyopsn.shop
                            Source: 13.2.db0740f8e4.exe.400000.0.raw.unpackString decryptor: nearycrepso.shop
                            Source: 13.2.db0740f8e4.exe.400000.0.raw.unpackString decryptor: pancakedipyps.click
                            Source: 13.2.db0740f8e4.exe.400000.0.raw.unpackString decryptor: lid=%s&j=%s&ver=4.0
                            Source: 13.2.db0740f8e4.exe.400000.0.raw.unpackString decryptor: TeslaBrowser/5.5
                            Source: 13.2.db0740f8e4.exe.400000.0.raw.unpackString decryptor: - Screen Resoluton:
                            Source: 13.2.db0740f8e4.exe.400000.0.raw.unpackString decryptor: - Physical Installed Memory:
                            Source: 13.2.db0740f8e4.exe.400000.0.raw.unpackString decryptor: Workgroup: -
                            Source: 13.2.db0740f8e4.exe.400000.0.raw.unpackString decryptor: FATE99--test
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00415D89 CryptUnprotectData,13_2_00415D89
                            Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=e0ac53ba53.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0HTTP Parser: No favicon
                            Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=e0ac53ba53.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0HTTP Parser: No favicon
                            Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=e0ac53ba53.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0HTTP Parser: No favicon
                            Source: file.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txtJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeFile opened: C:\Windows\SysWOW64\msvcr100.dll
                            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: c061393b55.exe, 00000009.00000003.1987194818.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: c061393b55.exe, 00000009.00000003.2002034297.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: Handler.pdbxa source: db0740f8e4.exe, 0000000B.00000002.2224918424.00000000038D9000.00000004.00000800.00020000.00000000.sdmp, db0740f8e4.exe, 0000000B.00000000.2021154039.00000000005F2000.00000002.00000001.01000000.0000001F.sdmp
                            Source: Binary string: BasicDisplay.pdb source: dxdiag.exe, 00000013.00000003.2071866630.000002B0A0551000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: c061393b55.exe, 00000009.00000003.2004321815.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: c061393b55.exe, 00000009.00000003.1988223511.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: c061393b55.exe, 00000009.00000003.1988362704.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: c061393b55.exe, 00000009.00000003.1987333299.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb(('GCTL source: c061393b55.exe, 00000009.00000003.1989574571.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: c061393b55.exe, 00000009.00000003.1988867285.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: Handler.pdb source: db0740f8e4.exe, 0000000B.00000002.2224918424.00000000038D9000.00000004.00000800.00020000.00000000.sdmp, db0740f8e4.exe, 0000000B.00000000.2021154039.00000000005F2000.00000002.00000001.01000000.0000001F.sdmp
                            Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: c061393b55.exe, 00000009.00000003.1988362704.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: c061393b55.exe, 00000009.00000003.1988758273.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: c061393b55.exe, 00000009.00000003.1987499038.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: c061393b55.exe, 00000009.00000003.1987037746.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: c061393b55.exe, 00000009.00000003.1989574571.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: c061393b55.exe, 00000009.00000003.1987037746.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: c061393b55.exe, 00000009.00000003.1988994617.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: c061393b55.exe, 00000009.00000003.1988657125.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: c061393b55.exe, 00000009.00000003.1987194818.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: BasicDisplay.pdbUGP source: dxdiag.exe, 00000013.00000003.2071866630.000002B0A0551000.00000004.00000020.00020000.00000000.sdmp
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: number of queries: 1001
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: number of queries: 1001
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: number of queries: 1001
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then movzx edx, byte ptr [esp+ecx+01h]13_2_00441816
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then mov eax, esi13_2_0043D0D0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then movzx ecx, byte ptr [esp+eax-533305EEh]13_2_0043D0D0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then movzx edx, byte ptr [esp+ecx+34h]13_2_0040C080
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then movzx edx, word ptr [eax]13_2_004442E0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then mov word ptr [edx], cx13_2_00418BA2
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 4B884A2Eh13_2_00444C20
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then mov ecx, edx13_2_00430F03
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then mov byte ptr [edi], cl13_2_0042F716
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then movzx edx, byte ptr [esp+eax-1CAAACA4h]13_2_00417054
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then movzx ecx, byte ptr [esp+eax+7E534795h]13_2_0041B021
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then mov byte ptr [ebx], al13_2_0041B021
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then movzx ebp, byte ptr [esp+edi+02h]13_2_004438E0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then movzx ebp, byte ptr [esp+edi+02h]13_2_004438F9
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then movzx ebp, byte ptr [esp+edi+02h]13_2_004438FB
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then movzx edx, byte ptr [esp+eax+482C66D0h]13_2_00422880
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then movzx ebx, bx13_2_00427885
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then movzx ebx, byte ptr [eax+edx]13_2_0041F170
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then mov dword ptr [ebp-2Ch], eax13_2_004421E9
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then mov byte ptr [edi+10h], 00000000h13_2_004421E9
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then movzx ebx, byte ptr [esi]13_2_0041618C
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then cmp word ptr [esi+eax+02h], 0000h13_2_0041BA52
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then mov esi, ecx13_2_0041BA52
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then mov byte ptr [esi], cl13_2_0041BA52
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then mov dword ptr [esi], FFFFFFFFh13_2_00402210
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then movzx ebx, byte ptr [edx]13_2_0043A230
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then mov byte ptr [esi], cl13_2_00431AF5
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then movzx edx, byte ptr [esp+ebx+0Bh]13_2_0040B280
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then cmp dword ptr [edi+esi*8], 01FCE602h13_2_00440A90
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then movzx edx, byte ptr [esp+ecx+01h]13_2_00441B50
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then mov byte ptr [edi], bl13_2_00409360
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then mov word ptr [eax], cx13_2_00422370
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then mov byte ptr [edi], cl13_2_0042FB7D
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then movzx eax, byte ptr [ecx+edi]13_2_00408320
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h13_2_00419B30
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then movsx eax, byte ptr [esi+ecx]13_2_0041F3E0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then mov byte ptr [esi], al13_2_0041B3F2
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then mov ecx, eax13_2_0041AB90
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then jmp ecx13_2_00428C62
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then mov ecx, eax13_2_00427C10
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then movzx edx, byte ptr [esp+eax-000000D1h]13_2_00414C30
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then mov ecx, eax13_2_00418492
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then movzx edx, word ptr [ebx]13_2_0043CD40
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then mov ebx, dword ptr [edi+04h]13_2_0042C5E0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then mov byte ptr [esi], al13_2_0041B58F
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h13_2_004195B6
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h13_2_004195B6
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then mov edi, edx13_2_0043E6E0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then movzx eax, word ptr [edx]13_2_0043E6E0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then mov ecx, edx13_2_00430F4E
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then mov ecx, edx13_2_00430F54
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then mov word ptr [ebx], ax13_2_0041A770
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]13_2_00407730
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then movzx ecx, word ptr [edi+esi*4]13_2_00407730
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then movzx eax, byte ptr [esp+edx+7C605D08h]13_2_00427FC0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then movzx edi, byte ptr [esp+eax-209D22B7h]13_2_00427FC0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then movzx ebp, byte ptr [esp+edi+02h]13_2_004437D0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then movzx ecx, byte ptr [esp+eax+04h]13_2_0042A7F0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then mov edx, ecx13_2_0042A7F0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then mov ecx, eax13_2_00427FFD
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then mov edx, ecx13_2_0042AF92
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then mov word ptr [eax], cx13_2_0042AF92
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 4x nop then mov edx, ecx13_2_0042AFB0
                            Source: chrome.exeMemory has grown: Private usage: 1MB later: 17MB
                            Source: firefox.exeMemory has grown: Private usage: 1MB later: 48MB

                            Networking

                            barindex
                            C2 URLs / IPs found in malware configuration
                            Source: Malware configuration extractorURLs: framekgirus.shop
                            Source: Malware configuration extractorURLs: abruptyopsn.shop
                            Source: Malware configuration extractorURLs: pancakedipyps.click
                            Source: Malware configuration extractorURLs: wholersorie.shop
                            Source: Malware configuration extractorURLs: tirepublicerj.shop
                            Source: Malware configuration extractorURLs: noisycuttej.shop
                            Source: Malware configuration extractorURLs: cloudewahsj.shop
                            Source: Malware configuration extractorURLs: rabidcowse.shop
                            Source: Malware configuration extractorURLs: nearycrepso.shop
                            Source: Malware configuration extractorIPs: 185.215.113.43
                            Source: Joe Sandbox ViewIP Address: 185.215.113.43 185.215.113.43
                            Source: Joe Sandbox ViewIP Address: 185.215.113.43 185.215.113.43
                            Source: Joe Sandbox ViewIP Address: 104.26.9.59 104.26.9.59
                            Source: Joe Sandbox ViewASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
                            Source: C:\Users\user\Desktop\file.exeCode function: 1_2_005DE0C0 recv,recv,recv,recv,1_2_005DE0C0
                            Source: e0ac53ba53.exe, e0ac53ba53.exe, 00000015.00000003.2402936438.0000000001258000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2403897693.000000000125A000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2473339717.0000000001466000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/
                            Source: cf4bd6029c.exe, 00000016.00000003.2473339717.0000000001466000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/9yH
                            Source: cf4bd6029c.exe, 00000016.00000003.2473339717.0000000001466000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/mine/random.exe
                            Source: cf4bd6029c.exe, 00000016.00000003.2473339717.0000000001466000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/mine/random.exexp
                            Source: e0ac53ba53.exe, 00000015.00000003.2403897693.000000000125A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/off/def.exe
                            Source: e0ac53ba53.exe, 00000015.00000003.2402936438.0000000001258000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2403897693.000000000125A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/off/def.exe;_cd_
                            Source: e0ac53ba53.exe, 00000015.00000003.2402936438.0000000001258000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2403897693.000000000125A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/off/def.exeEMM
                            Source: e0ac53ba53.exe, 00000015.00000003.2402936438.0000000001272000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/off/def.exeG
                            Source: e0ac53ba53.exe, 00000015.00000003.2402936438.0000000001258000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2403897693.000000000125A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/off/def.exek
                            Source: e0ac53ba53.exe, 00000015.00000003.2402936438.0000000001258000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2403897693.000000000125A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/off/def.exestat
                            Source: cf4bd6029c.exe, 00000016.00000003.2473339717.0000000001466000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/qy
                            Source: e0ac53ba53.exe, 00000015.00000003.2402936438.0000000001258000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2403897693.000000000125A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/sc
                            Source: cf4bd6029c.exe, 00000016.00000003.2473339717.0000000001466000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/steam/random.exe
                            Source: e0ac53ba53.exe, 00000015.00000003.2398710636.00000000058F9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16:80/off/def.exe
                            Source: cf4bd6029c.exe, 00000016.00000003.2473339717.0000000001466000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16:80/steam/random.exe9(
                            Source: c061393b55.exe, 00000009.00000003.1989144362.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987333299.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.dig
                            Source: c061393b55.exe, 00000009.00000003.1989144362.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987333299.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digX
                            Source: c061393b55.exe, 00000009.00000003.2004321815.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989355560.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digi
                            Source: c061393b55.exe, 00000009.00000003.2004321815.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989355560.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digiX
                            Source: c061393b55.exe, 00000009.00000003.1996177520.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2004321815.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1999665526.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1998279885.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988994617.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987499038.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2003819372.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988223511.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988362704.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988867285.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988657125.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1995564840.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989574571.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989144362.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1992018588.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987912445.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2002034297.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989355560.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987333299.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988062517.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1992018588.0000020D0AFCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
                            Source: e0ac53ba53.exe, 00000015.00000003.2177654462.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2264083329.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
                            Source: e0ac53ba53.exe, 00000015.00000003.2177654462.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2264083329.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
                            Source: c061393b55.exe, 00000009.00000003.1996177520.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2004321815.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1999665526.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1998279885.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988994617.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987499038.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2003819372.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988223511.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988362704.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988867285.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988657125.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1995564840.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989574571.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989144362.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987912445.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2002034297.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989355560.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987333299.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988062517.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1992018588.0000020D0AFCC000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988758273.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
                            Source: c061393b55.exe, 00000009.00000003.1996177520.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2004321815.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1999665526.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1998279885.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988994617.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987499038.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2003819372.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988223511.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988362704.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988867285.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988657125.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1995564840.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989574571.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989144362.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1992018588.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987912445.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2002034297.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989355560.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987333299.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988062517.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988758273.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
                            Source: c061393b55.exe, 00000009.00000003.1996177520.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2004321815.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1999665526.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1998279885.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988994617.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987499038.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2003819372.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988223511.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988362704.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988867285.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988657125.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1995564840.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989574571.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989144362.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1992018588.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987912445.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2002034297.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989355560.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987333299.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988062517.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1992018588.0000020D0AFCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
                            Source: c061393b55.exe, 0000000A.00000003.2016296141.00000200D38FA000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2017404603.00000200D392B000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2015079597.00000200D38FD000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2016878815.00000200D3907000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
                            Source: c061393b55.exe, 0000000A.00000003.2014574686.00000200D3CBC000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2015713624.00000200D3956000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2015589940.00000200D3CFB000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2016222955.00000200D3956000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2014574686.00000200D3CFB000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2016659534.00000200D3956000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://code.activestate.com/recipes/577916/
                            Source: e0ac53ba53.exe, 00000015.00000003.2177654462.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2264083329.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
                            Source: c061393b55.exe, 00000009.00000003.1996177520.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2004321815.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1999665526.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1998279885.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988994617.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987499038.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2003819372.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988223511.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988362704.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988867285.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988657125.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1995564840.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989574571.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989144362.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1992018588.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987912445.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2002034297.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989355560.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987333299.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988062517.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1992018588.0000020D0AFCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
                            Source: e0ac53ba53.exe, 00000015.00000003.2177654462.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2264083329.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
                            Source: e0ac53ba53.exe, 00000015.00000003.2177654462.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2264083329.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
                            Source: c061393b55.exe, 00000009.00000003.1996177520.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2004321815.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1999665526.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1998279885.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988994617.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987499038.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2003819372.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988223511.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988362704.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988867285.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988657125.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1995564840.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989574571.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989144362.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987912445.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2002034297.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989355560.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987333299.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988062517.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1992018588.0000020D0AFCC000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988758273.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
                            Source: c061393b55.exe, 00000009.00000003.1996177520.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2004321815.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1999665526.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1998279885.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988994617.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987499038.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2003819372.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988223511.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988362704.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988867285.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988657125.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1995564840.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989574571.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989144362.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1992018588.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987912445.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2002034297.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989355560.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987333299.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988062517.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988758273.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
                            Source: c061393b55.exe, 00000009.00000003.1988758273.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
                            Source: e0ac53ba53.exe, 00000015.00000003.2177654462.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2264083329.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
                            Source: c061393b55.exe, 00000009.00000003.1996177520.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2004321815.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1999665526.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1998279885.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988994617.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987499038.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2003819372.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988223511.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988362704.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988867285.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988657125.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1995564840.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989574571.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989144362.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987912445.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2002034297.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989355560.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987333299.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988062517.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1992018588.0000020D0AFCC000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988758273.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
                            Source: e0ac53ba53.exe, 00000015.00000003.2177654462.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2264083329.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
                            Source: c061393b55.exe, 0000000A.00000003.2016384535.00000200D3CAD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://foo/bar.tar.gz
                            Source: c061393b55.exe, 0000000A.00000003.2016384535.00000200D3CAD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://foo/bar.tgz
                            Source: c061393b55.exe, 00000009.00000003.1996177520.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2004321815.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1999665526.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1998279885.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988994617.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987499038.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2003819372.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988223511.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988362704.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988867285.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988657125.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1995564840.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989574571.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989144362.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987912445.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2002034297.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989355560.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987333299.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988062517.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1992018588.0000020D0AFCC000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988758273.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
                            Source: c061393b55.exe, 00000009.00000003.1996177520.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2004321815.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1999665526.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1998279885.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988994617.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987499038.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2003819372.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988223511.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988362704.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988867285.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988657125.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1995564840.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989574571.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989144362.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1992018588.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987912445.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2002034297.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989355560.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987333299.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988062517.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1992018588.0000020D0AFCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
                            Source: c061393b55.exe, 00000009.00000003.1996177520.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2004321815.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1999665526.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1998279885.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988994617.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987499038.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2003819372.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988223511.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988362704.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988867285.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988657125.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1995564840.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989574571.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989144362.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1992018588.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987912445.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2002034297.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989355560.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987333299.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988062517.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1992018588.0000020D0AFCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
                            Source: c061393b55.exe, 00000009.00000003.1996177520.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2004321815.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1999665526.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1998279885.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988994617.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987499038.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2003819372.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988223511.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988362704.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988867285.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988657125.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1995564840.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989574571.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989144362.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1992018588.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987912445.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2002034297.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989355560.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987333299.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988062517.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988758273.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
                            Source: e0ac53ba53.exe, 00000015.00000003.2177654462.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2264083329.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
                            Source: c061393b55.exe, 0000000A.00000003.2012943211.00000200D381B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2196857322.0000000001470000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2196857322.0000000001470000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://store.steampowered.com/privacy_agreement/
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2196857322.0000000001470000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://store.steampowered.com/subscriber_agreement/
                            Source: c061393b55.exe, 00000009.00000003.2002233300.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/
                            Source: c061393b55.exe, 00000009.00000003.2002233300.0000020D0AFD2000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2002367730.0000020D0AFD2000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2002233300.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                            Source: c061393b55.exe, 0000000A.00000003.2012943211.00000200D381B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
                            Source: c061393b55.exe, 00000009.00000003.1996177520.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2004321815.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1999665526.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1998279885.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988994617.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987499038.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2003819372.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988223511.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988362704.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988867285.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988657125.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1995564840.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989574571.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989144362.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987912445.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2002034297.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989355560.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1987333299.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988062517.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1992018588.0000020D0AFCC000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1988758273.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
                            Source: c061393b55.exe, 0000000A.00000003.2018241146.00000200D3D46000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2017650493.00000200D3D58000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2017986400.00000200D3D58000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assign
                            Source: c061393b55.exe, 0000000A.00000003.2018241146.00000200D3D95000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2017932668.00000200D3D8A000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2017986400.00000200D3D48000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2017650493.00000200D3D46000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.valvesoftware.com/legal.htm
                            Source: e0ac53ba53.exe, 00000015.00000003.2177654462.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2264083329.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://x1.c.lencr.org/0
                            Source: e0ac53ba53.exe, 00000015.00000003.2177654462.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2264083329.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://x1.i.lencr.org/0
                            Source: e0ac53ba53.exe, 00000015.00000003.2136075338.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2135809145.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2135567631.00000000058EE000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2214275467.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2214000185.0000000005B6D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
                            Source: c061393b55.exe, 00000009.00000003.2002397575.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://blog.jaraco.com/skeleton
                            Source: e0ac53ba53.exe, 00000015.00000003.2182075458.0000000005930000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696497267574.12791&key=1696497267400700
                            Source: e0ac53ba53.exe, 00000015.00000003.2182075458.0000000005930000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1696497267574.12791&key=1696497267400700002.1&cta
                            Source: e0ac53ba53.exe, 00000015.00000003.2136075338.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2135809145.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2135567631.00000000058EE000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2214275467.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2214000185.0000000005B6D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
                            Source: e0ac53ba53.exe, 00000015.00000003.2136075338.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2135809145.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2135567631.00000000058EE000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2214275467.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2214000185.0000000005B6D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
                            Source: e0ac53ba53.exe, 00000015.00000003.2136075338.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2135809145.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2135567631.00000000058EE000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2214275467.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2214000185.0000000005B6D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
                            Source: e0ac53ba53.exe, 00000015.00000003.2211666253.0000000001253000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fa
                            Source: cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2386293420.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fas
                            Source: e0ac53ba53.exe, 00000015.00000003.2211666253.0000000001253000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastl
                            Source: e0ac53ba53.exe, 00000015.00000003.2211666253.0000000001253000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastl9
                            Source: e0ac53ba53.exe, 00000015.00000003.2211666253.0000000001253000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly
                            Source: e0ac53ba53.exe, 00000015.00000003.2211666253.0000000001253000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.
                            Source: e0ac53ba53.exe, 00000015.00000003.2211666253.0000000001253000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.s
                            Source: cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.stea
                            Source: cf4bd6029c.exe, 00000016.00000003.2300941183.0000000001461000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2328481395.0000000001461000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamst
                            Source: cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2386293420.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic
                            Source: cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com
                            Source: e0ac53ba53.exe, 00000015.00000003.2123524420.000000000120D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/p
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
                            Source: cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/sticke
                            Source: e0ac53ba53.exe, 00000015.00000003.2123524420.000000000120D000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2386293420.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
                            Source: cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2386293420.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
                            Source: cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2386293420.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/moda
                            Source: cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
                            Source: cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2386293420.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66
                            Source: e0ac53ba53.exe, 00000015.00000003.2123524420.000000000120D000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2385193919.000000000145D000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2385193919.000000000145D000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
                            Source: e0ac53ba53.exe, 00000015.00000003.2123524420.000000000120D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalConte
                            Source: cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2385193919.000000000145D000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
                            Source: cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2385193919.000000000145D000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=eng
                            Source: e0ac53ba53.exe, 00000015.00000003.2123524420.000000000120D000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
                            Source: e0ac53ba53.exe, 00000015.00000003.2123524420.000000000120D000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2385193919.000000000145D000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2385193919.000000000145D000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
                            Source: cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2386293420.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrE
                            Source: e0ac53ba53.exe, 00000015.00000003.2123524420.000000000120D000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
                            Source: e0ac53ba53.exe, 00000015.00000003.2123524420.000000000120D000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2385193919.000000000145D000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2385193919.000000000145D000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
                            Source: e0ac53ba53.exe, 00000015.00000003.2123524420.000000000120D000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2385193919.000000000145D000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=oOCAGrkRfpQ6&l=e
                            Source: e0ac53ba53.exe, 00000015.00000003.2123524420.000000000120D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css
                            Source: cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
                            Source: cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.#U
                            Source: cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2386293420.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=en
                            Source: cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
                            Source: cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
                            Source: e0ac53ba53.exe, 00000015.00000003.2123524420.000000000120D000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
                            Source: e0ac53ba53.exe, 00000015.00000003.2123524420.000000000120D000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2385193919.000000000145D000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
                            Source: e0ac53ba53.exe, 00000015.00000003.2123524420.000000000120D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2385193919.000000000145D000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
                            Source: e0ac53ba53.exe, 00000015.00000003.2182075458.0000000005930000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contile-images.services.mozilla.com/5b4DH7KHAf2n_mNaLjNi1-UAoKmM9rhqaA9w7FyznHo.10943.jpg
                            Source: e0ac53ba53.exe, 00000015.00000003.2182075458.0000000005930000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
                            Source: c061393b55.exe, 0000000A.00000003.2013216168.00000200D3956000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2015713624.00000200D3956000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2012943211.00000200D3956000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2015079597.00000200D3956000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2014154422.00000200D3956000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2016222955.00000200D3956000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2011995088.00000200D3956000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2016659534.00000200D3956000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
                            Source: c061393b55.exe, 0000000A.00000003.2009187642.00000200D35DF000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2009919760.00000200D35D0000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2010438253.00000200D35DE000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2009512862.00000200D35D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
                            Source: c061393b55.exe, 0000000A.00000003.2009187642.00000200D35DF000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2009919760.00000200D35D0000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2010438253.00000200D35DE000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2009512862.00000200D35D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
                            Source: c061393b55.exe, 00000009.00000003.2002397575.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.metadata.html
                            Source: c061393b55.exe, 00000009.00000003.2002397575.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/reference/import.html#finders-and-loaders
                            Source: e0ac53ba53.exe, 00000015.00000003.2136075338.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2135809145.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2135567631.00000000058EE000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2214275467.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2214000185.0000000005B6D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
                            Source: e0ac53ba53.exe, 00000015.00000003.2136075338.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2135809145.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2135567631.00000000058EE000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2214275467.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2214000185.0000000005B6D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
                            Source: e0ac53ba53.exe, 00000015.00000003.2136075338.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2135809145.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2135567631.00000000058EE000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2214275467.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2214000185.0000000005B6D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
                            Source: c061393b55.exe, 0000000A.00000003.2009187642.00000200D35DF000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2009919760.00000200D35D0000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2010438253.00000200D35DE000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2009512862.00000200D35D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
                            Source: c061393b55.exe, 00000009.00000003.2002397575.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/astral-sh/ruff
                            Source: c061393b55.exe, 00000009.00000003.2005103211.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.2001827694.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/mhammond/pywin32
                            Source: c061393b55.exe, 00000009.00000003.2003163720.0000020D0AFC7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.md
                            Source: c061393b55.exe, 00000009.00000003.2003163720.0000020D0AFC7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/wheel
                            Source: c061393b55.exe, 00000009.00000003.2003163720.0000020D0AFC7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/pypa/wheel/issues
                            Source: c061393b55.exe, 0000000A.00000003.2009512862.00000200D35D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
                            Source: c061393b55.exe, 0000000A.00000003.2009187642.00000200D35DF000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2009919760.00000200D35D0000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2010438253.00000200D35DE000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2009512862.00000200D35D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
                            Source: c061393b55.exe, 0000000A.00000003.2013381002.00000200D3870000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2017270583.00000200D3870000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2015929025.00000200D3870000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2012943211.00000200D3870000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2015459372.00000200D3870000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2011705665.00000200D3C7B000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2013548335.00000200D3881000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/issues/86361.
                            Source: c061393b55.exe, 00000009.00000003.2002397575.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/importlib_metadata
                            Source: c061393b55.exe, 00000009.00000003.2002397575.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/importlib_metadata/actions/workflows/main.yml/badge.svg
                            Source: c061393b55.exe, 00000009.00000003.2002397575.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/importlib_metadata/actions?query=workflow%3A%22tests%22
                            Source: c061393b55.exe, 00000009.00000003.2002397575.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/importlib_metadata/issues
                            Source: c061393b55.exe, 0000000A.00000003.2009187642.00000200D35DF000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2009919760.00000200D35D0000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2010438253.00000200D35DE000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2009512862.00000200D35D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://help.steampowered.com/en/
                            Source: c061393b55.exe, 00000009.00000003.2002397575.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/badge/skeleton-2024-informational
                            Source: c061393b55.exe, 00000009.00000003.2002397575.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/charliermarsh/ruff/main/assets
                            Source: c061393b55.exe, 00000009.00000003.2002397575.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/pyversions/importlib_metadata.svg
                            Source: c061393b55.exe, 00000009.00000003.2002397575.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://img.shields.io/pypi/v/importlib_metadata.svg
                            Source: e0ac53ba53.exe, 00000015.00000003.2182075458.0000000005930000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqrfQHr4pbW4ZbWfpbY7ReNxR3UIG8zInwYIFIVs9eYi
                            Source: c061393b55.exe, 00000009.00000003.2002397575.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://importlib-metadata.readthedocs.io/
                            Source: c061393b55.exe, 00000009.00000003.2002397575.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://importlib-metadata.readthedocs.io/en/latest/?badge=latest
                            Source: c061393b55.exe, 0000000A.00000003.2016384535.00000200D3CAD000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2016968942.00000200D3C05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mahler:8092/site-updates.py
                            Source: db0740f8e4.exe, 0000000D.00000002.2182568912.0000000001484000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pancakedipyps.click/
                            Source: db0740f8e4.exe, 0000000D.00000002.2182568912.0000000001484000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pancakedipyps.click/&v
                            Source: db0740f8e4.exe, 0000000D.00000002.2182568912.0000000001484000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pancakedipyps.click/api
                            Source: db0740f8e4.exe, 0000000D.00000002.2182568912.0000000001484000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pancakedipyps.click/api_
                            Source: db0740f8e4.exe, 0000000D.00000002.2182568912.0000000001484000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pancakedipyps.click/pi
                            Source: c061393b55.exe, 0000000A.00000003.2006568345.00000200D19EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://peps.python.org/pep-0205/
                            Source: c061393b55.exe, 00000009.00000003.2002397575.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/importlib_metadata
                            Source: c061393b55.exe, 00000009.00000003.2003163720.0000020D0AFC7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/setuptools/
                            Source: e0ac53ba53.exe, 00000015.00000003.2122754416.00000000011EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://rabidcowse.shop/
                            Source: c061393b55.exe, 00000009.00000003.2002397575.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://readthedocs.org/projects/importlib-metadata/badge/?version=latest
                            Source: c061393b55.exe, 0000000A.00000003.2011159095.00000200D395F000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2011310369.00000200D38E6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html
                            Source: c061393b55.exe, 0000000A.00000003.2011995088.00000200D38DB000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2011230346.00000200D3908000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2011159095.00000200D395F000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2015079597.00000200D38DB000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2011995088.00000200D390F000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2016912360.00000200D38DD000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2013381002.00000200D38DB000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2016296141.00000200D38DD000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2012943211.00000200D390F000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2012943211.00000200D38DB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
                            Source: c061393b55.exe, 0000000A.00000003.2011159095.00000200D395F000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2011159095.00000200D3920000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr;
                            Source: c061393b55.exe, 0000000A.00000003.2011159095.00000200D395F000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2011159095.00000200D3920000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr;r
                            Source: e0ac53ba53.exe, 00000015.00000003.2192715354.000000000593A000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2176182863.0000000005934000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2180876129.000000000593C000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2178530480.000000000593A000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2370059128.000000000146A000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2473339717.0000000001466000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.0000000001418000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2326932620.0000000001469000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sputnik-1985.com/
                            Source: cf4bd6029c.exe, 00000016.00000003.2326932620.0000000001469000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2300615762.000000000146F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sputnik-1985.com/%k4
                            Source: cf4bd6029c.exe, 00000016.00000003.2300615762.000000000146F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sputnik-1985.com/=k
                            Source: cf4bd6029c.exe, 00000016.00000003.2299818266.0000000001418000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sputnik-1985.com/D
                            Source: cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sputnik-1985.com/api
                            Source: cf4bd6029c.exe, 00000016.00000003.2386196260.0000000001480000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2473339717.0000000001466000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2370059128.0000000001480000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sputnik-1985.com/api&v
                            Source: e0ac53ba53.exe, 00000015.00000003.2180807299.00000000058B1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://sputnik-1985.com/api1/i
                            Source: cf4bd6029c.exe, 00000016.00000003.2482960425.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sputnik-1985.com/apiG
                            Source: cf4bd6029c.exe, 00000016.00000003.2473339717.0000000001466000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sputnik-1985.com/apiS
                            Source: e0ac53ba53.exe, 00000015.00000003.2123524420.000000000120D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sputnik-1985.com/apidP.a
                            Source: cf4bd6029c.exe, 00000016.00000003.2261072491.0000000005B31000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2265081690.0000000005B31000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://sputnik-1985.com/apisYE
                            Source: cf4bd6029c.exe, 00000016.00000003.2482960425.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2386293420.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sputnik-1985.com/apitt
                            Source: e0ac53ba53.exe, 00000015.00000003.2402936438.0000000001258000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2240142291.0000000001258000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2403897693.000000000125A000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2253717755.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sputnik-1985.com/apiu(
                            Source: cf4bd6029c.exe, 00000016.00000003.2326932620.0000000001469000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sputnik-1985.com/l
                            Source: cf4bd6029c.exe, 00000016.00000003.2326932620.0000000001469000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sputnik-1985.com/s
                            Source: cf4bd6029c.exe, 00000016.00000003.2385366413.000000000141B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sputnik-1985.com/w
                            Source: e0ac53ba53.exe, e0ac53ba53.exe, 00000015.00000003.2176064084.000000000592E000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2176304559.000000000592E000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2176446364.000000000592E000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2252886391.0000000005931000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2386196260.0000000001480000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2259495619.0000000005BB2000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2370059128.0000000001480000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.0000000001407000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sputnik-1985.com:443/api
                            Source: cf4bd6029c.exe, 00000016.00000003.2299582589.0000000001480000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sputnik-1985.com:443/apibe
                            Source: e0ac53ba53.exe, 00000015.00000003.2402936438.0000000001258000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2403897693.000000000125A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sputnik-1985.com:443/apive-Browser
                            Source: cf4bd6029c.exe, 00000016.00000003.2300941183.0000000001461000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steamcommunity.co
                            Source: cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steamcommunity.com/
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steamcommunity.com/discussions/
                            Source: cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steamcommunity.com/linkfi
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2196857322.0000000001470000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steamcommunity.com/market/
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steamcommunity.com/my/wishlist/
                            Source: e0ac53ba53.exe, 00000015.00000003.2122754416.00000000011D4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steamcommunity.com/workshop/
                            Source: e0ac53ba53.exe, 00000015.00000003.2122754416.00000000011CF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
                            Source: e0ac53ba53.exe, 00000015.00000003.2402936438.0000000001258000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2240142291.0000000001258000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2403897693.000000000125A000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2211777661.000000000125D000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2211666253.0000000001253000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2253717755.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store.steamp
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store.steampowered.com/
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store.steampowered.com/about/
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store.steampowered.com/explore/
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2196857322.0000000001470000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store.steampowered.com/legal/
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store.steampowered.com/mobile
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store.steampowered.com/news/
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store.steampowered.com/points/shop/
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store.steampowered.com/privacy_agreement/
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store.steampowered.com/stats/
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store.steampowered.com/steam_refunds/
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://store.steampowered.com/subscriber_agreement/
                            Source: e0ac53ba53.exe, 00000015.00000003.2180936760.0000000005BD8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
                            Source: e0ac53ba53.exe, 00000015.00000003.2180936760.0000000005BD8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
                            Source: c061393b55.exe, 00000009.00000003.2002397575.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/badges/package/pypi/importlib-metadata
                            Source: c061393b55.exe, 00000009.00000003.2002397575.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/subscription/pkg/pypi-importlib-metadata?utm_source=pypi-importlib-metadata&utm
                            Source: c061393b55.exe, 0000000A.00000003.2016801906.00000200D3D4F000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2018241146.00000200D3D46000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2017650493.00000200D3D58000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2018067959.00000200D3D6C000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2016801906.00000200D3D5F000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2017986400.00000200D3D58000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
                            Source: c061393b55.exe, 00000009.00000003.2003163720.0000020D0AFC7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wheel.readthedocs.io/
                            Source: c061393b55.exe, 00000009.00000003.2003163720.0000020D0AFC7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://wheel.readthedocs.io/en/stable/news.html
                            Source: c061393b55.exe, 0000000A.00000003.2014574686.00000200D3CBC000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2017270583.00000200D3870000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2015929025.00000200D3870000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2015589940.00000200D3CFB000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2014574686.00000200D3CFB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gz
                            Source: e0ac53ba53.exe, 00000015.00000003.2182075458.0000000005930000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15e498ec2b39921665a1fbc954bff40a8106629178eadc64
                            Source: e0ac53ba53.exe, 00000015.00000003.2136075338.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2135809145.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2135567631.00000000058EE000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2214275467.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2214000185.0000000005B6D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
                            Source: e0ac53ba53.exe, 00000015.00000003.2136075338.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2135809145.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2135567631.00000000058EE000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2214275467.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2214000185.0000000005B6D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
                            Source: e0ac53ba53.exe, 00000015.00000003.2182075458.0000000005930000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.marriott.com/default.mi?utm_source=admarketplace&utm_medium=cpc&utm_campaign=Marriott_Pr
                            Source: e0ac53ba53.exe, 00000015.00000003.2180936760.0000000005BD8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.d-GHL1OW1fkT
                            Source: e0ac53ba53.exe, 00000015.00000003.2180936760.0000000005BD8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.sYEKgG4Or0s6
                            Source: e0ac53ba53.exe, 00000015.00000003.2180936760.0000000005BD8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
                            Source: e0ac53ba53.exe, 00000015.00000003.2180936760.0000000005BD8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
                            Source: e0ac53ba53.exe, 00000015.00000003.2180936760.0000000005BD8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
                            Source: c061393b55.exe, 00000009.00000003.1996177520.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.openssl.org/H
                            Source: c061393b55.exe, 0000000A.00000003.2016384535.00000200D3CAD000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2016968942.00000200D3C05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/
                            Source: c061393b55.exe, 00000009.00000003.2003163720.0000020D0AFC7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/dev/peps/pep-0427/
                            Source: e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
                            Source: firefox.exe, 0000002C.00000002.2386552647.000001E18E35A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00437A60 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,13_2_00437A60
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00437A60 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,13_2_00437A60
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00437C10 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,13_2_00437C10
                            Source: C:\Windows\System32\dxdiag.exeWindows user hook set: 0 mouse low level C:\Windows\system32\dinput8.dll

                            System Summary

                            barindex
                            .NET source code contains very large array initializations
                            Source: 31f59e2a09.exe.5.dr, -----------------------------------------.csLarge array initialization: _200E_202D_200B_206E_206D_202E_202C_200C_200F_202D_200C_202B_202D_202B_206B_200E_206D_206C_202A_200C_202C_200E_200E_200B_206C_202A_206C_206B_206D_202E_206C_202D_202D_202E_206A_200E_206A_200E_202C_206F_202E: array initializer size 438272
                            PE file contains section with special chars
                            Source: file.exeStatic PE information: section name:
                            Source: file.exeStatic PE information: section name: .idata
                            Source: skotes.exe.1.drStatic PE information: section name:
                            Source: skotes.exe.1.drStatic PE information: section name: .idata
                            Source: random[1].exe.5.drStatic PE information: section name:
                            Source: random[1].exe.5.drStatic PE information: section name: .idata
                            Source: cf4bd6029c.exe.5.drStatic PE information: section name:
                            Source: cf4bd6029c.exe.5.drStatic PE information: section name: .idata
                            Source: random[2].exe.5.drStatic PE information: section name:
                            Source: random[2].exe.5.drStatic PE information: section name: .idata
                            Source: random[2].exe.5.drStatic PE information: section name:
                            Source: 05c06146f2.exe.5.drStatic PE information: section name:
                            Source: 05c06146f2.exe.5.drStatic PE information: section name: .idata
                            Source: 05c06146f2.exe.5.drStatic PE information: section name:
                            Source: random[2].exe1.5.drStatic PE information: section name:
                            Source: random[2].exe1.5.drStatic PE information: section name: .idata
                            Source: caf9f1bef3.exe.5.drStatic PE information: section name:
                            Source: caf9f1bef3.exe.5.drStatic PE information: section name: .idata
                            Source: random[2].exe2.5.drStatic PE information: section name:
                            Source: random[2].exe2.5.drStatic PE information: section name: .idata
                            Source: random[2].exe2.5.drStatic PE information: section name:
                            Source: b3206cdf20.exe.5.drStatic PE information: section name:
                            Source: b3206cdf20.exe.5.drStatic PE information: section name: .idata
                            Source: b3206cdf20.exe.5.drStatic PE information: section name:
                            Source: random[3].exe1.5.drStatic PE information: section name:
                            Source: random[3].exe1.5.drStatic PE information: section name: .idata
                            Source: random[3].exe1.5.drStatic PE information: section name:
                            Source: 01c00b6fe2.exe.5.drStatic PE information: section name:
                            Source: 01c00b6fe2.exe.5.drStatic PE information: section name: .idata
                            Source: 01c00b6fe2.exe.5.drStatic PE information: section name:
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess Stats: CPU usage > 49%
                            Source: C:\Users\user\Desktop\file.exeFile created: C:\Windows\Tasks\skotes.jobJump to behavior
                            Source: C:\Users\user\Desktop\file.exeCode function: 1_2_006188601_2_00618860
                            Source: C:\Users\user\Desktop\file.exeCode function: 1_2_006170491_2_00617049
                            Source: C:\Users\user\Desktop\file.exeCode function: 1_2_006178BB1_2_006178BB
                            Source: C:\Users\user\Desktop\file.exeCode function: 1_2_006131A81_2_006131A8
                            Source: C:\Users\user\Desktop\file.exeCode function: 1_2_005D4B301_2_005D4B30
                            Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00612D101_2_00612D10
                            Source: C:\Users\user\Desktop\file.exeCode function: 1_2_005D4DE01_2_005D4DE0
                            Source: C:\Users\user\Desktop\file.exeCode function: 1_2_00607F361_2_00607F36
                            Source: C:\Users\user\Desktop\file.exeCode function: 1_2_0061779B1_2_0061779B
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeCode function: 2_2_006988602_2_00698860
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeCode function: 2_2_006970492_2_00697049
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeCode function: 2_2_006978BB2_2_006978BB
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeCode function: 2_2_006931A82_2_006931A8
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeCode function: 2_2_00654B302_2_00654B30
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeCode function: 2_2_00692D102_2_00692D10
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeCode function: 2_2_00654DE02_2_00654DE0
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeCode function: 2_2_00687F362_2_00687F36
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeCode function: 2_2_0069779B2_2_0069779B
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeCode function: 3_2_006988603_2_00698860
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeCode function: 3_2_006970493_2_00697049
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeCode function: 3_2_006978BB3_2_006978BB
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeCode function: 3_2_006931A83_2_006931A8
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeCode function: 3_2_00654B303_2_00654B30
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeCode function: 3_2_00692D103_2_00692D10
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeCode function: 3_2_00654DE03_2_00654DE0
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeCode function: 3_2_00687F363_2_00687F36
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeCode function: 3_2_0069779B3_2_0069779B
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0043D0D013_2_0043D0D0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0040E16E13_2_0040E16E
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0040D17213_2_0040D172
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00408A6013_2_00408A60
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_004442E013_2_004442E0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_004352B013_2_004352B0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00421B3013_2_00421B30
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00418BA213_2_00418BA2
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00444C2013_2_00444C20
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_004324EE13_2_004324EE
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0043CE9013_2_0043CE90
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0042875013_2_00428750
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0042571313_2_00425713
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0042F71613_2_0042F716
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0043785013_2_00437850
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0041906A13_2_0041906A
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0042601013_2_00426010
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_004438E013_2_004438E0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_004180F013_2_004180F0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_004438F913_2_004438F9
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_004438FB13_2_004438FB
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0042788513_2_00427885
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0041D8B013_2_0041D8B0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0040695013_2_00406950
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0044495013_2_00444950
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0043210B13_2_0043210B
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0040391013_2_00403910
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0042991713_2_00429917
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0040612013_2_00406120
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0040B92C13_2_0040B92C
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0042F1C113_2_0042F1C1
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_004239EB13_2_004239EB
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0042118013_2_00421180
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0041618C13_2_0041618C
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0043099F13_2_0043099F
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0041F9A013_2_0041F9A0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0041D1B013_2_0041D1B0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0042E9B013_2_0042E9B0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0041BA5213_2_0041BA52
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0043025E13_2_0043025E
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0042621B13_2_0042621B
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0042BA2013_2_0042BA20
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0041722213_2_00417222
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00443A3013_2_00443A30
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_004042C013_2_004042C0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00443AC013_2_00443AC0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_004302CD13_2_004302CD
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0040F2D013_2_0040F2D0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0040B28013_2_0040B280
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00402B4013_2_00402B40
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00443B6013_2_00443B60
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00409B7013_2_00409B70
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0042237013_2_00422370
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00429B7B13_2_00429B7B
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0042FB7D13_2_0042FB7D
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00405B0013_2_00405B00
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00440B0013_2_00440B00
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00428B1013_2_00428B10
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00419B3013_2_00419B30
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00411BDE13_2_00411BDE
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_004123EC13_2_004123EC
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00428C6213_2_00428C62
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0043C46013_2_0043C460
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0043B41013_2_0043B410
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00441C2613_2_00441C26
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_004064C013_2_004064C0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0042F4E113_2_0042F4E1
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0041D4A013_2_0041D4A0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00408D1013_2_00408D10
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0043E52013_2_0043E520
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00442DCA13_2_00442DCA
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00415DD813_2_00415DD8
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00425DA013_2_00425DA0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_004085B013_2_004085B0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0040966013_2_00409660
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00404E2013_2_00404E20
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0043C6C013_2_0043C6C0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0043E6E013_2_0043E6E0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_004186E513_2_004186E5
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0044468013_2_00444680
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0041DE9013_2_0041DE90
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0043DF6013_2_0043DF60
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00429F7C13_2_00429F7C
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0043370713_2_00433707
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00402F1013_2_00402F10
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0040773013_2_00407730
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00427FC013_2_00427FC0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_004437D013_2_004437D0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00433FDF13_2_00433FDF
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_004127E013_2_004127E0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0042A7F013_2_0042A7F0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00434FF013_2_00434FF0
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0042AF9213_2_0042AF92
                            Source: Joe Sandbox ViewDropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
                            Source: Joe Sandbox ViewDropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
                            Source: C:\Users\user\Desktop\file.exeCode function: String function: 005E80C0 appears 130 times
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeCode function: String function: 0066DF80 appears 36 times
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeCode function: String function: 006680C0 appears 260 times
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: String function: 00408280 appears 47 times
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: String function: 00414C20 appears 145 times
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1704 -ip 1704
                            Source: unknownDriver loaded: C:\Windows\System32\drivers\mstee.sys
                            Source: file.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                            Source: random[2].exe.5.drStatic PE information: Section: scpusmou ZLIB complexity 0.9944594096109006
                            Source: 05c06146f2.exe.5.drStatic PE information: Section: scpusmou ZLIB complexity 0.9944594096109006
                            Source: random[2].exe2.5.drStatic PE information: Section: ltmerovd ZLIB complexity 0.9905096780028944
                            Source: b3206cdf20.exe.5.drStatic PE information: Section: ltmerovd ZLIB complexity 0.9905096780028944
                            Source: random[3].exe0.5.drStatic PE information: Section: .bss ZLIB complexity 1.0003340475731894
                            Source: 24a1c81f44.exe.5.drStatic PE information: Section: .bss ZLIB complexity 1.0003340475731894
                            Source: random[3].exe1.5.drStatic PE information: Section: xpqdeyne ZLIB complexity 0.9943291037669301
                            Source: 01c00b6fe2.exe.5.drStatic PE information: Section: xpqdeyne ZLIB complexity 0.9943291037669301
                            Source: random[1].exe1.5.drStatic PE information: Section: .BSS ZLIB complexity 1.0003366411102483
                            Source: random[3].exe2.5.drStatic PE information: Section: .bss ZLIB complexity 1.0005296610169492
                            Source: a85084d20f.exe.5.drStatic PE information: Section: .bss ZLIB complexity 1.0005296610169492
                            Source: random[5].exe.5.drStatic PE information: Section: .bss ZLIB complexity 1.0003366411102483
                            Source: 4e6501ac3b.exe.5.drStatic PE information: Section: .bss ZLIB complexity 1.0003366411102483
                            Source: 05c06146f2.exe.5.drStatic PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
                            Source: cf4bd6029c.exe.5.drStatic PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
                            Source: random[2].exe.5.drStatic PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
                            Source: random[1].exe.5.drStatic PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
                            Source: random[3].exe0.5.dr, OqnvDGyNnPPvG6T46X.csCryptographic APIs: 'CreateDecryptor'
                            Source: random[3].exe0.5.dr, OqnvDGyNnPPvG6T46X.csCryptographic APIs: 'CreateDecryptor'
                            Source: 24a1c81f44.exe.5.dr, OqnvDGyNnPPvG6T46X.csCryptographic APIs: 'CreateDecryptor'
                            Source: 24a1c81f44.exe.5.dr, OqnvDGyNnPPvG6T46X.csCryptographic APIs: 'CreateDecryptor'
                            Source: random[3].exe2.5.dr, OqnvDGyNnPPvG6T46X.csCryptographic APIs: 'CreateDecryptor'
                            Source: random[3].exe2.5.dr, OqnvDGyNnPPvG6T46X.csCryptographic APIs: 'CreateDecryptor'
                            Source: a85084d20f.exe.5.dr, OqnvDGyNnPPvG6T46X.csCryptographic APIs: 'CreateDecryptor'
                            Source: a85084d20f.exe.5.dr, OqnvDGyNnPPvG6T46X.csCryptographic APIs: 'CreateDecryptor'
                            Source: random[5].exe.5.dr, OqnvDGyNnPPvG6T46X.csCryptographic APIs: 'CreateDecryptor'
                            Source: random[5].exe.5.dr, OqnvDGyNnPPvG6T46X.csCryptographic APIs: 'CreateDecryptor'
                            Source: 4e6501ac3b.exe.5.dr, OqnvDGyNnPPvG6T46X.csCryptographic APIs: 'CreateDecryptor'
                            Source: 4e6501ac3b.exe.5.dr, OqnvDGyNnPPvG6T46X.csCryptographic APIs: 'CreateDecryptor'
                            Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@119/177@0/16
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0043D0D0 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,13_2_0043D0D0
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[1].exeJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeMutant created: NULL
                            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2380:120:WilError_03
                            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7560:120:WilError_03
                            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1668:120:WilError_03
                            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6424:120:WilError_03
                            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:180:120:WilError_03
                            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1968:120:WilError_03
                            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7132:120:WilError_03
                            Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1704
                            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1360:120:WilError_03
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeMutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
                            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7148:120:WilError_03
                            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2632:120:WilError_03
                            Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\abc3bc1985Jump to behavior
                            Source: C:\Windows\SysWOW64\WerFault.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe")
                            Source: C:\Windows\System32\dxdiag.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                            Source: C:\Windows\System32\dxdiag.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                            Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
                            Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
                            Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
                            Source: C:\Windows\System32\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe")
                            Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
                            Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
                            Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
                            Source: C:\Windows\System32\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe")
                            Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
                            Source: C:\Users\user\Desktop\file.exeFile read: C:\Users\desktop.iniJump to behavior
                            Source: C:\Users\user\Desktop\file.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                            Source: e0ac53ba53.exe, 00000015.00000003.2138764965.00000000058BE000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2137878311.00000000058D9000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2244101523.0000000005BD2000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2214864510.0000000005B58000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2240820646.0000000005B3B000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2218578516.0000000005B3D000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                            Source: file.exeVirustotal: Detection: 58%
                            Source: file.exeReversingLabs: Detection: 57%
                            Source: file.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
                            Source: skotes.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
                            Source: skotes.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
                            Source: C:\Users\user\Desktop\file.exeFile read: C:\Users\user\Desktop\file.exeJump to behavior
                            Source: unknownProcess created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
                            Source: C:\Users\user\Desktop\file.exeProcess created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
                            Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                            Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe "C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe"
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeProcess created: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe "C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe"
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exe "C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exe"
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeProcess created: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exe "C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exe"
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1704 -ip 1704
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 908
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "dxdiag /t C:\Users\user\AppData\Local\Bunny\Info.txt"
                            Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\System32\dxdiag.exe dxdiag /t C:\Users\user\AppData\Local\Bunny\Info.txt
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exe "C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exe"
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exe "C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exe"
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe "C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe"
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exe "C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exe"
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
                            Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exe "C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exe"
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
                            Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe
                            Source: C:\Windows\System32\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
                            Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
                            Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9876 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exe "C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exe"
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
                            Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                            Source: unknownProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
                            Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2012 --field-trial-handle=2008,i,17564928535210738890,5689791328347770168,262144 /prefetch:8
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe
                            Source: C:\Windows\System32\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe "C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe"
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe "C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe"
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9876 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                            Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2292 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2204 -prefsLen 25358 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f00215ad-1a9f-4dfa-990d-aaf96e354c4f} 7252 "\\.\pipe\gecko-crash-server-pipe.7252" 1a1d166eb10 socket
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
                            Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=1976 --field-trial-handle=1956,i,11737153874150669047,12636588976470451220,262144 /prefetch:8
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: C:\Users\user\AppData\Local\Temp\1033699001\8c9c7a39f7.exe "C:\Users\user\AppData\Local\Temp\1033699001\8c9c7a39f7.exe"
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
                            Source: C:\Users\user\Desktop\file.exeProcess created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe "C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe" Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exe "C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exe" Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exe "C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exe" Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exe "C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exe" Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe "C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe" Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exe "C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exe" Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exe "C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exe" Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe "C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe" Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: C:\Users\user\AppData\Local\Temp\1033699001\8c9c7a39f7.exe "C:\Users\user\AppData\Local\Temp\1033699001\8c9c7a39f7.exe" Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: unknown unknownJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: unknown unknownJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: unknown unknownJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: unknown unknownJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: unknown unknownJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: unknown unknownJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: unknown unknownJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: unknown unknownJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: unknown unknownJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeProcess created: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe "C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe" Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "dxdiag /t C:\Users\user\AppData\Local\Bunny\Info.txt"Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exeJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9876 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandboxJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1704 -ip 1704Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9876 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandboxJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeProcess created: unknown unknownJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeProcess created: unknown unknownJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeProcess created: unknown unknownJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeProcess created: unknown unknownJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeProcess created: unknown unknownJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeProcess created: unknown unknownJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeProcess created: unknown unknownJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeProcess created: unknown unknownJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeProcess created: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exe "C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exe"Jump to behavior
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess created: unknown unknown
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\dxdiag.exe dxdiag /t C:\Users\user\AppData\Local\Bunny\Info.txt
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeProcess created: unknown unknown
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeProcess created: unknown unknown
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeProcess created: unknown unknown
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeProcess created: unknown unknown
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeProcess created: unknown unknown
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeProcess created: unknown unknown
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeProcess created: unknown unknown
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeProcess created: unknown unknown
                            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2012 --field-trial-handle=2008,i,17564928535210738890,5689791328347770168,262144 /prefetch:8
                            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                            Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                            Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2292 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2204 -prefsLen 25358 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f00215ad-1a9f-4dfa-990d-aaf96e354c4f} 7252 "\\.\pipe\gecko-crash-server-pipe.7252" 1a1d166eb10 socket
                            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                            Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=1976 --field-trial-handle=1956,i,11737153874150669047,12636588976470451220,262144 /prefetch:8
                            Source: C:\Users\user\AppData\Local\Temp\1033699001\8c9c7a39f7.exeProcess created: unknown unknown
                            Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                            Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                            Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                            Source: C:\Users\user\Desktop\file.exeSection loaded: apphelp.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: winmm.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: wininet.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: sspicli.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: kernel.appcore.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: uxtheme.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: mstask.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: windows.storage.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: wldp.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: mpr.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: dui70.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: duser.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: chartv.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: oleacc.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: atlthunk.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: textinputframework.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: coreuicomponents.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: coremessaging.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: ntmarta.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: wintypes.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: wintypes.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: wintypes.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: wtsapi32.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: winsta.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: textshaping.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: propsys.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: windows.fileexplorer.common.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: iertutil.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: profapi.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: explorerframe.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: edputil.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: urlmon.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: srvcli.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: netutils.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: appresolver.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: bcp47langs.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: slc.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: userenv.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: sppc.dllJump to behavior
                            Source: C:\Users\user\Desktop\file.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: apphelp.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: winmm.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: wininet.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: kernel.appcore.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: winmm.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: wininet.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: kernel.appcore.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: winmm.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: wininet.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: sspicli.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: iertutil.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: windows.storage.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: wldp.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: profapi.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: kernel.appcore.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: winhttp.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: mswsock.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: iphlpapi.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: winnsi.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: urlmon.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: srvcli.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: netutils.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: uxtheme.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: propsys.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: edputil.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: wintypes.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: appresolver.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: bcp47langs.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: slc.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: userenv.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: sppc.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSection loaded: apphelp.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeSection loaded: uxtheme.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeSection loaded: kernel.appcore.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeSection loaded: version.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeSection loaded: vcruntime140.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeSection loaded: python3.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeSection loaded: libffi-8.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeSection loaded: propsys.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeSection loaded: vcruntime140_1.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeSection loaded: libcrypto-3.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeSection loaded: iphlpapi.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeSection loaded: libssl-3.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeSection loaded: sqlite3.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeSection loaded: mswsock.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeSection loaded: pywintypes313.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeSection loaded: dnsapi.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeSection loaded: rasadhlp.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeSection loaded: fwpuclnt.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeSection loaded: sspicli.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeSection loaded: dpapi.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeSection loaded: cryptbase.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeSection loaded: ntmarta.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeSection loaded: kernel.appcore.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: mscoree.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: apphelp.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: kernel.appcore.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: version.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: windows.storage.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: wldp.dllJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: windows.storage.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: wldp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: winhttp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: webio.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: mswsock.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: iphlpapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: winnsi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: sspicli.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: dnsapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: rasadhlp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: fwpuclnt.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: schannel.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: mskeyprotect.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: ntasn1.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: ncrypt.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: ncryptsslp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: msasn1.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: cryptsp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: rsaenh.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: cryptbase.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: gpapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: dpapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: kernel.appcore.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: uxtheme.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: wbemcomn.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: amsi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: userenv.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: profapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: version.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Windows\System32\cmd.exeSection loaded: apphelp.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: apphelp.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: kernel.appcore.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: uxtheme.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: dxdiagn.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: d3d11.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: d3d12.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: cryptsp.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: powrprof.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: devobj.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: winmmbase.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: dxgi.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: wmiclnt.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: dxgi.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: umpdc.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: msasn1.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: wbemcomn.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: amsi.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: userenv.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: profapi.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: winbrand.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: wldp.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: windows.storage.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: wldp.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: dsound.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: resourcepolicyclient.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: devrtl.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: spinf.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: drvstore.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: rsaenh.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: cryptbase.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: gpapi.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: spfileq.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: wifidisplay.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: sspicli.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: dnsapi.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: iphlpapi.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: mswsock.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: wlanapi.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: mmdevapi.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: mfplat.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: rtworkq.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: mf.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: mfcore.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: ksuser.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: mfsensorgroup.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: comppkgsup.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: windows.media.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: windows.applicationmodel.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: twinapi.appcore.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: appxdeploymentclient.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: windows.staterepositoryps.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: wintypes.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: dispuserer.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: d3d12core.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: dxcore.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: d3d10warp.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: dxilconv.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: d3dscache.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: d3d10warp.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: d3d10warp.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: d3d10warp.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: d3d10warp.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: d3d10warp.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: d3d10warp.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: d3d10warp.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: d3d10warp.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: d3d10warp.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: d3d9.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: dwmapi.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: d3d10warp.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: mscat32.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: d3d9.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: dwmapi.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: d3d10warp.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: ddraw.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: dciman32.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: d3d10warp.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: winmm.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: avrt.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: audioses.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: msacm32.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: midimap.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: winmm.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: winmm.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: dinput8.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: inputhost.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: coremessaging.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: propsys.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: coreuicomponents.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: ntmarta.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: coremessaging.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: hid.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: winmm.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: devenum.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: msdmo.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: quartz.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: d3d9.dll
                            Source: C:\Windows\System32\dxdiag.exeSection loaded: dwmapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: apphelp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: winmm.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: windows.storage.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: wldp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: winhttp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: webio.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: mswsock.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: iphlpapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: winnsi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: sspicli.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: dnsapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: rasadhlp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: fwpuclnt.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: schannel.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: mskeyprotect.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: ntasn1.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: ncrypt.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: ncryptsslp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: msasn1.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: cryptsp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: rsaenh.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: cryptbase.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: gpapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: dpapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: kernel.appcore.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: uxtheme.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: wbemcomn.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: amsi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: userenv.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: profapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: version.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: mscoree.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: textshaping.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: textinputframework.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: coreuicomponents.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: coremessaging.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: ntmarta.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: coremessaging.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: wintypes.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: wintypes.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: wintypes.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: propsys.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: urlmon.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: iertutil.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: srvcli.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: netutils.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: windows.shell.servicehostbuilder.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: onecoreuapcommonproxystub.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: ieframe.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: netapi32.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: wkscli.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: windows.staterepositoryps.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: edputil.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: secur32.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: mlang.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: wininet.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: policymanager.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: msvcp110_win.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSection loaded: onecorecommonproxystub.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: apphelp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: winmm.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: windows.storage.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: wldp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: winhttp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: webio.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: mswsock.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: iphlpapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: winnsi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: sspicli.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: dnsapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: rasadhlp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: fwpuclnt.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: schannel.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: mskeyprotect.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: ntasn1.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: ncrypt.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: ncryptsslp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: msasn1.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: cryptsp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: rsaenh.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: cryptbase.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: gpapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: dpapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: kernel.appcore.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: uxtheme.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: wbemcomn.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: amsi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: userenv.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: profapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: version.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSection loaded: apphelp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSection loaded: winmm.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSection loaded: sspicli.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSection loaded: wininet.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSection loaded: rstrtmgr.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSection loaded: ncrypt.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSection loaded: ntasn1.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSection loaded: iertutil.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSection loaded: windows.storage.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSection loaded: wldp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSection loaded: profapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSection loaded: kernel.appcore.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSection loaded: ondemandconnroutehelper.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSection loaded: winhttp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSection loaded: mswsock.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSection loaded: iphlpapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSection loaded: winnsi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSection loaded: urlmon.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSection loaded: srvcli.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSection loaded: netutils.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSection loaded: dpapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSection loaded: cryptbase.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSection loaded: dnsapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSection loaded: fwpuclnt.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSection loaded: rasadhlp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSection loaded: ntmarta.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSection loaded: mozglue.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSection loaded: wsock32.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSection loaded: vcruntime140.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSection loaded: msvcp140.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSection loaded: vcruntime140.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: wsock32.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: version.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: winmm.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: mpr.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: wininet.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: iphlpapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: userenv.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: uxtheme.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: kernel.appcore.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: windows.storage.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: wldp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: napinsp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: pnrpnsp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: wshbth.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: nlaapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: mswsock.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: dnsapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: winrnr.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: fwpuclnt.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: rasadhlp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: napinsp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: pnrpnsp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: wshbth.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: nlaapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: mswsock.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: dnsapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: winrnr.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: fwpuclnt.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: napinsp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: pnrpnsp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: wshbth.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: nlaapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: mswsock.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: dnsapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: winrnr.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: fwpuclnt.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: napinsp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: pnrpnsp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: wshbth.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: nlaapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: mswsock.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: dnsapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: winrnr.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: fwpuclnt.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: sspicli.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: profapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: napinsp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: pnrpnsp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: wshbth.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: nlaapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: mswsock.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: dnsapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: winrnr.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: fwpuclnt.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: napinsp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: pnrpnsp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: wshbth.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: nlaapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: mswsock.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: dnsapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: winrnr.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: fwpuclnt.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: napinsp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: pnrpnsp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: wshbth.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: nlaapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: mswsock.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: dnsapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: winrnr.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: fwpuclnt.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: napinsp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: pnrpnsp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: wshbth.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: nlaapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: mswsock.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: dnsapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: winrnr.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: fwpuclnt.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: napinsp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: pnrpnsp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: wshbth.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: nlaapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: mswsock.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: dnsapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: winrnr.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: fwpuclnt.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: napinsp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: pnrpnsp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: wshbth.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: nlaapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: mswsock.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: dnsapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: winrnr.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: fwpuclnt.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: napinsp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: pnrpnsp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: wshbth.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: nlaapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: mswsock.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: dnsapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: winrnr.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: fwpuclnt.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: napinsp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: pnrpnsp.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: wshbth.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: nlaapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: mswsock.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: dnsapi.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: winrnr.dll
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeSection loaded: fwpuclnt.dll
                            Source: C:\Users\user\Desktop\file.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32Jump to behavior
                            Source: Window RecorderWindow detected: More than 3 window changes detected
                            Source: file.exeStatic file information: File size 3266048 > 1048576
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeFile opened: C:\Windows\SysWOW64\msvcr100.dll
                            Source: file.exeStatic PE information: Raw size of sihywpwu is bigger than: 0x100000 < 0x2b1a00
                            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: c061393b55.exe, 00000009.00000003.1987194818.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: D:\a\1\b\bin\amd64\select.pdb source: c061393b55.exe, 00000009.00000003.2002034297.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: Handler.pdbxa source: db0740f8e4.exe, 0000000B.00000002.2224918424.00000000038D9000.00000004.00000800.00020000.00000000.sdmp, db0740f8e4.exe, 0000000B.00000000.2021154039.00000000005F2000.00000002.00000001.01000000.0000001F.sdmp
                            Source: Binary string: BasicDisplay.pdb source: dxdiag.exe, 00000013.00000003.2071866630.000002B0A0551000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: c061393b55.exe, 00000009.00000003.2004321815.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: c061393b55.exe, 00000009.00000003.1988223511.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: c061393b55.exe, 00000009.00000003.1988362704.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: c061393b55.exe, 00000009.00000003.1987333299.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb(('GCTL source: c061393b55.exe, 00000009.00000003.1989574571.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: c061393b55.exe, 00000009.00000003.1988867285.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: Handler.pdb source: db0740f8e4.exe, 0000000B.00000002.2224918424.00000000038D9000.00000004.00000800.00020000.00000000.sdmp, db0740f8e4.exe, 0000000B.00000000.2021154039.00000000005F2000.00000002.00000001.01000000.0000001F.sdmp
                            Source: Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: c061393b55.exe, 00000009.00000003.1988362704.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: c061393b55.exe, 00000009.00000003.1988758273.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: c061393b55.exe, 00000009.00000003.1987499038.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: c061393b55.exe, 00000009.00000003.1987037746.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: c061393b55.exe, 00000009.00000003.1989574571.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: c061393b55.exe, 00000009.00000003.1987037746.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: c061393b55.exe, 00000009.00000003.1988994617.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: c061393b55.exe, 00000009.00000003.1988657125.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: c061393b55.exe, 00000009.00000003.1987194818.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp
                            Source: Binary string: BasicDisplay.pdbUGP source: dxdiag.exe, 00000013.00000003.2071866630.000002B0A0551000.00000004.00000020.00020000.00000000.sdmp

                            Data Obfuscation

                            barindex
                            Detected unpacking (changes PE section rights)
                            Source: C:\Users\user\Desktop\file.exeUnpacked PE file: 1.2.file.exe.5d0000.0.unpack :EW;.rsrc:W;.idata :W;sihywpwu:EW;snftdmjr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;sihywpwu:EW;snftdmjr:EW;.taggant:EW;
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeUnpacked PE file: 2.2.skotes.exe.650000.0.unpack :EW;.rsrc:W;.idata :W;sihywpwu:EW;snftdmjr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;sihywpwu:EW;snftdmjr:EW;.taggant:EW;
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeUnpacked PE file: 3.2.skotes.exe.650000.0.unpack :EW;.rsrc:W;.idata :W;sihywpwu:EW;snftdmjr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;sihywpwu:EW;snftdmjr:EW;.taggant:EW;
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeUnpacked PE file: 29.2.cf4bd6029c.exe.a40000.0.unpack :EW;.rsrc:W;.idata :W;ikmnjisi:EW;nmpoliea:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ikmnjisi:EW;nmpoliea:EW;.taggant:EW;
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeUnpacked PE file: 40.2.caf9f1bef3.exe.3a0000.0.unpack :EW;.rsrc:W;.idata :W;dqmrytmu:EW;pxqnvvkn:EW;.taggant:EW; vs :ER;.rsrc:W;
                            .NET source code contains method to dynamically call methods (often used by packers)
                            Source: random[3].exe0.5.dr, OqnvDGyNnPPvG6T46X.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
                            Source: 24a1c81f44.exe.5.dr, OqnvDGyNnPPvG6T46X.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
                            Source: random[3].exe2.5.dr, OqnvDGyNnPPvG6T46X.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
                            Source: a85084d20f.exe.5.dr, OqnvDGyNnPPvG6T46X.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
                            Source: random[5].exe.5.dr, OqnvDGyNnPPvG6T46X.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
                            Source: 4e6501ac3b.exe.5.dr, OqnvDGyNnPPvG6T46X.cs.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
                            Source: random[3].exe0.5.drStatic PE information: 0xB22C430A [Sun Sep 21 17:53:14 2064 UTC]
                            Source: initial sampleStatic PE information: section where entry point is pointing to: .taggant
                            Source: random[1].exe1.5.drStatic PE information: real checksum: 0x0 should be: 0x5fe22
                            Source: 54d18f4f90.exe.5.drStatic PE information: real checksum: 0x0 should be: 0x750ae
                            Source: random[4].exe1.5.drStatic PE information: real checksum: 0x0 should be: 0x750ae
                            Source: random[4].exe.5.drStatic PE information: real checksum: 0x0 should be: 0x8969b
                            Source: 8c9c7a39f7.exe.5.drStatic PE information: real checksum: 0xb4cee should be: 0x1bb421
                            Source: 05c06146f2.exe.5.drStatic PE information: real checksum: 0x1ce1ad should be: 0x1cca5e
                            Source: random[2].exe1.5.drStatic PE information: real checksum: 0x2a84a7 should be: 0x2ae5ef
                            Source: cf4bd6029c.exe.5.drStatic PE information: real checksum: 0x305c54 should be: 0x2fb89a
                            Source: random[2].exe.5.drStatic PE information: real checksum: 0x1ce1ad should be: 0x1cca5e
                            Source: caf9f1bef3.exe.5.drStatic PE information: real checksum: 0x2a84a7 should be: 0x2ae5ef
                            Source: random[1].exe.5.drStatic PE information: real checksum: 0x305c54 should be: 0x2fb89a
                            Source: ba5ccf6bd8.exe.5.drStatic PE information: real checksum: 0xfb337 should be: 0x1074fb
                            Source: random[3].exe1.5.drStatic PE information: real checksum: 0x44dc0e should be: 0x44e79f
                            Source: 31f59e2a09.exe.5.drStatic PE information: real checksum: 0x0 should be: 0x8969b
                            Source: random[4].exe0.5.drStatic PE information: real checksum: 0xfb337 should be: 0x1074fb
                            Source: 01c00b6fe2.exe.5.drStatic PE information: real checksum: 0x44dc0e should be: 0x44e79f
                            Source: file.exeStatic PE information: real checksum: 0x31fa27 should be: 0x320240
                            Source: skotes.exe.1.drStatic PE information: real checksum: 0x31fa27 should be: 0x320240
                            Source: random[2].exe2.5.drStatic PE information: real checksum: 0x1e9b4a should be: 0x1e796b
                            Source: b3206cdf20.exe.5.drStatic PE information: real checksum: 0x1e9b4a should be: 0x1e796b
                            Source: random[3].exe.5.drStatic PE information: real checksum: 0xb4cee should be: 0x1bb421
                            Source: file.exeStatic PE information: section name:
                            Source: file.exeStatic PE information: section name: .idata
                            Source: file.exeStatic PE information: section name: sihywpwu
                            Source: file.exeStatic PE information: section name: snftdmjr
                            Source: file.exeStatic PE information: section name: .taggant
                            Source: skotes.exe.1.drStatic PE information: section name:
                            Source: skotes.exe.1.drStatic PE information: section name: .idata
                            Source: skotes.exe.1.drStatic PE information: section name: sihywpwu
                            Source: skotes.exe.1.drStatic PE information: section name: snftdmjr
                            Source: skotes.exe.1.drStatic PE information: section name: .taggant
                            Source: random[1].exe.5.drStatic PE information: section name:
                            Source: random[1].exe.5.drStatic PE information: section name: .idata
                            Source: random[1].exe.5.drStatic PE information: section name: ikmnjisi
                            Source: random[1].exe.5.drStatic PE information: section name: nmpoliea
                            Source: random[1].exe.5.drStatic PE information: section name: .taggant
                            Source: cf4bd6029c.exe.5.drStatic PE information: section name:
                            Source: cf4bd6029c.exe.5.drStatic PE information: section name: .idata
                            Source: cf4bd6029c.exe.5.drStatic PE information: section name: ikmnjisi
                            Source: cf4bd6029c.exe.5.drStatic PE information: section name: nmpoliea
                            Source: cf4bd6029c.exe.5.drStatic PE information: section name: .taggant
                            Source: random[2].exe.5.drStatic PE information: section name:
                            Source: random[2].exe.5.drStatic PE information: section name: .idata
                            Source: random[2].exe.5.drStatic PE information: section name:
                            Source: random[2].exe.5.drStatic PE information: section name: scpusmou
                            Source: random[2].exe.5.drStatic PE information: section name: wkvcxnam
                            Source: random[2].exe.5.drStatic PE information: section name: .taggant
                            Source: 05c06146f2.exe.5.drStatic PE information: section name:
                            Source: 05c06146f2.exe.5.drStatic PE information: section name: .idata
                            Source: 05c06146f2.exe.5.drStatic PE information: section name:
                            Source: 05c06146f2.exe.5.drStatic PE information: section name: scpusmou
                            Source: 05c06146f2.exe.5.drStatic PE information: section name: wkvcxnam
                            Source: 05c06146f2.exe.5.drStatic PE information: section name: .taggant
                            Source: random[2].exe1.5.drStatic PE information: section name:
                            Source: random[2].exe1.5.drStatic PE information: section name: .idata
                            Source: random[2].exe1.5.drStatic PE information: section name: dqmrytmu
                            Source: random[2].exe1.5.drStatic PE information: section name: pxqnvvkn
                            Source: random[2].exe1.5.drStatic PE information: section name: .taggant
                            Source: caf9f1bef3.exe.5.drStatic PE information: section name:
                            Source: caf9f1bef3.exe.5.drStatic PE information: section name: .idata
                            Source: caf9f1bef3.exe.5.drStatic PE information: section name: dqmrytmu
                            Source: caf9f1bef3.exe.5.drStatic PE information: section name: pxqnvvkn
                            Source: caf9f1bef3.exe.5.drStatic PE information: section name: .taggant
                            Source: random[2].exe2.5.drStatic PE information: section name:
                            Source: random[2].exe2.5.drStatic PE information: section name: .idata
                            Source: random[2].exe2.5.drStatic PE information: section name:
                            Source: random[2].exe2.5.drStatic PE information: section name: ltmerovd
                            Source: random[2].exe2.5.drStatic PE information: section name: uydrgwnj
                            Source: random[2].exe2.5.drStatic PE information: section name: .taggant
                            Source: b3206cdf20.exe.5.drStatic PE information: section name:
                            Source: b3206cdf20.exe.5.drStatic PE information: section name: .idata
                            Source: b3206cdf20.exe.5.drStatic PE information: section name:
                            Source: b3206cdf20.exe.5.drStatic PE information: section name: ltmerovd
                            Source: b3206cdf20.exe.5.drStatic PE information: section name: uydrgwnj
                            Source: b3206cdf20.exe.5.drStatic PE information: section name: .taggant
                            Source: random[3].exe1.5.drStatic PE information: section name:
                            Source: random[3].exe1.5.drStatic PE information: section name: .idata
                            Source: random[3].exe1.5.drStatic PE information: section name:
                            Source: random[3].exe1.5.drStatic PE information: section name: xpqdeyne
                            Source: random[3].exe1.5.drStatic PE information: section name: nykjqzsf
                            Source: random[3].exe1.5.drStatic PE information: section name: .taggant
                            Source: 01c00b6fe2.exe.5.drStatic PE information: section name:
                            Source: 01c00b6fe2.exe.5.drStatic PE information: section name: .idata
                            Source: 01c00b6fe2.exe.5.drStatic PE information: section name:
                            Source: 01c00b6fe2.exe.5.drStatic PE information: section name: xpqdeyne
                            Source: 01c00b6fe2.exe.5.drStatic PE information: section name: nykjqzsf
                            Source: 01c00b6fe2.exe.5.drStatic PE information: section name: .taggant
                            Source: C:\Users\user\Desktop\file.exeCode function: 1_2_005ED91C push ecx; ret 1_2_005ED92F
                            Source: C:\Users\user\Desktop\file.exeCode function: 1_2_005E1359 push es; ret 1_2_005E135A
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeCode function: 2_2_0066D91C push ecx; ret 2_2_0066D92F
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeCode function: 2_2_0065BA83 push ss; retf 2_2_0065BA85
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeCode function: 3_2_0066D91C push ecx; ret 3_2_0066D92F
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeCode function: 3_2_0065BA83 push ss; retf 3_2_0065BA85
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_004499A1 push esp; ret 13_2_004499A2
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_0044AAD0 push ecx; retn 0041h13_2_0044AAD5
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeCode function: 21_3_058B3311 push ecx; retf 21_3_058B3312
                            Source: file.exeStatic PE information: section name: entropy: 7.019860685017432
                            Source: skotes.exe.1.drStatic PE information: section name: entropy: 7.019860685017432
                            Source: random[1].exe.5.drStatic PE information: section name: entropy: 7.06503557923827
                            Source: cf4bd6029c.exe.5.drStatic PE information: section name: entropy: 7.06503557923827
                            Source: random[2].exe.5.drStatic PE information: section name: scpusmou entropy: 7.953902861205792
                            Source: 05c06146f2.exe.5.drStatic PE information: section name: scpusmou entropy: 7.953902861205792
                            Source: random[2].exe1.5.drStatic PE information: section name: entropy: 7.7510645866137935
                            Source: caf9f1bef3.exe.5.drStatic PE information: section name: entropy: 7.7510645866137935
                            Source: random[2].exe2.5.drStatic PE information: section name: ltmerovd entropy: 7.9498479799331765
                            Source: b3206cdf20.exe.5.drStatic PE information: section name: ltmerovd entropy: 7.9498479799331765
                            Source: random[3].exe1.5.drStatic PE information: section name: xpqdeyne entropy: 7.955523872525168
                            Source: 01c00b6fe2.exe.5.drStatic PE information: section name: xpqdeyne entropy: 7.955523872525168
                            Source: random[4].exe.5.drStatic PE information: section name: .text entropy: 7.010866345977857
                            Source: 31f59e2a09.exe.5.drStatic PE information: section name: .text entropy: 7.010866345977857
                            Source: random[3].exe0.5.dr, OqnvDGyNnPPvG6T46X.csHigh entropy of concatenated method names: 'Qerauq6FF2', 'nW4lBacjpc', 'NBbmObeVEM', 'bqpm7jSIZK', 'sREmHxnXei', 'uu3mAcrNh4', 'n0OmcKY1xJ', 'A1VRDsBnZ', 'oqBlqdN3O', 'pRhoMmNSX'
                            Source: 24a1c81f44.exe.5.dr, OqnvDGyNnPPvG6T46X.csHigh entropy of concatenated method names: 'Qerauq6FF2', 'nW4lBacjpc', 'NBbmObeVEM', 'bqpm7jSIZK', 'sREmHxnXei', 'uu3mAcrNh4', 'n0OmcKY1xJ', 'A1VRDsBnZ', 'oqBlqdN3O', 'pRhoMmNSX'
                            Source: random[3].exe2.5.dr, OqnvDGyNnPPvG6T46X.csHigh entropy of concatenated method names: 'Qerauq6FF2', 'nW4lBacjpc', 'NBbmObeVEM', 'bqpm7jSIZK', 'sREmHxnXei', 'uu3mAcrNh4', 'n0OmcKY1xJ', 'A1VRDsBnZ', 'oqBlqdN3O', 'pRhoMmNSX'
                            Source: a85084d20f.exe.5.dr, OqnvDGyNnPPvG6T46X.csHigh entropy of concatenated method names: 'Qerauq6FF2', 'nW4lBacjpc', 'NBbmObeVEM', 'bqpm7jSIZK', 'sREmHxnXei', 'uu3mAcrNh4', 'n0OmcKY1xJ', 'A1VRDsBnZ', 'oqBlqdN3O', 'pRhoMmNSX'
                            Source: random[5].exe.5.dr, OqnvDGyNnPPvG6T46X.csHigh entropy of concatenated method names: 'Qerauq6FF2', 'nW4lBacjpc', 'NBbmObeVEM', 'bqpm7jSIZK', 'sREmHxnXei', 'uu3mAcrNh4', 'n0OmcKY1xJ', 'A1VRDsBnZ', 'oqBlqdN3O', 'pRhoMmNSX'
                            Source: 4e6501ac3b.exe.5.dr, OqnvDGyNnPPvG6T46X.csHigh entropy of concatenated method names: 'Qerauq6FF2', 'nW4lBacjpc', 'NBbmObeVEM', 'bqpm7jSIZK', 'sREmHxnXei', 'uu3mAcrNh4', 'n0OmcKY1xJ', 'A1VRDsBnZ', 'oqBlqdN3O', 'pRhoMmNSX'

                            Persistence and Installation Behavior

                            barindex
                            Found pyInstaller with non standard icon
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeProcess created: "C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe"
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\_sqlite3.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\charset_normalizer\md.cp313-win_amd64.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\freebl3[1].dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_BLAKE2b.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Temp\1033702001\31f59e2a09.exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_SHA384.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[1].exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\_overlapped.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\pyexpat.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\msvcp140[1].dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_aesni.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_chacha20.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_cbc.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[2].exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_RIPEMD160.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\vcruntime140[1].dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_MD4.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\charset_normalizer\md__mypyc.cp313-win_amd64.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile created: C:\ProgramData\nss3.dllJump to dropped file
                            Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_ecb.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\VCRUNTIME140_1.dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\select.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_SHA256.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[1].exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\mozglue[1].dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\_socket.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[4].exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_aes.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\_ssl.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_poly1305.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile created: C:\ProgramData\msvcp140.dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Util\_cpuid_c.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\_hashlib.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_SHA1.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_SHA224.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[5].exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_des3.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\win32\win32crypt.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile created: C:\ProgramData\vcruntime140.dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Temp\1033700001\24a1c81f44.exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[2].exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\VCRUNTIME140.dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\_lzma.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_ctr.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\_cffi_backend.cp313-win_amd64.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[5].exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Temp\1033707001\a0d135de95.exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_keccak.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\python313.dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\_bz2.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\sqlite3.dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_MD2.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_MD5.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile created: C:\ProgramData\mozglue.dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_Salsa20.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[3].exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ONMZACOW\random[2].exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Temp\1033704001\a85084d20f.exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Temp\1033699001\8c9c7a39f7.exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_SHA512.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ONMZACOW\random[1].exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Protocol\_scrypt.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_ghash_portable.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile created: C:\ProgramData\softokn3.dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\unicodedata.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_ARC4.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_BLAKE2s.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ONMZACOW\random[3].exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\PublicKey\_ec_ws.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_arc2.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_ofb.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile created: C:\Users\user\AppData\Local\Temp\F92YSIFAGW8CC4SRE.exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_cast.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[4].exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[4].exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile created: C:\ProgramData\freebl3.dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_ocb.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\pywin32_system32\pywintypes313.dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\_ctypes.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\_asyncio.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Temp\1033701001\01c00b6fe2.exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\softokn3[1].dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[1].exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_ghash_clmul.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\_queue.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_des.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\_wmi.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\nss3[1].dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Temp\1033703001\ba5ccf6bd8.exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\PublicKey\_ed25519.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[3].exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Util\_strxor.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\libcrypto-3.dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_cfb.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\libffi-8.dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\PublicKey\_curve25519.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\libssl-3.dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\PublicKey\_ed448.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Math\_modexp.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[2].exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Temp\1033706001\4e6501ac3b.exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[3].exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\PublicKey\_curve448.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\_multiprocessing.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile created: C:\Users\user\AppData\Local\Temp\1033705001\54d18f4f90.exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\_decimal.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile created: C:\Users\user\AppData\Local\Temp\ITH3569MCVRCZNYE5XQ77V.exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile created: C:\ProgramData\mozglue.dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile created: C:\ProgramData\nss3.dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile created: C:\ProgramData\msvcp140.dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile created: C:\ProgramData\freebl3.dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile created: C:\ProgramData\vcruntime140.dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile created: C:\ProgramData\softokn3.dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txtJump to behavior

                            Boot Survival

                            barindex
                            Creates multiple autostart registry keys
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run caf9f1bef3.exeJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cf4bd6029c.exeJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 05c06146f2.exeJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 959ae18948.exeJump to behavior
                            Monitors registry run keys for changes
                            Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeRegistry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
                            Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
                            Source: C:\Users\user\Desktop\file.exeWindow searched: window name: FilemonClassJump to behavior
                            Source: C:\Users\user\Desktop\file.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                            Source: C:\Users\user\Desktop\file.exeWindow searched: window name: RegmonClassJump to behavior
                            Source: C:\Users\user\Desktop\file.exeWindow searched: window name: FilemonClassJump to behavior
                            Source: C:\Users\user\Desktop\file.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeWindow searched: window name: FilemonClassJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeWindow searched: window name: RegmonClassJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeWindow searched: window name: FilemonClassJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeWindow searched: window name: FilemonClassJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeWindow searched: window name: RegmonClassJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeWindow searched: window name: FilemonClassJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeWindow searched: window name: FilemonClassJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeWindow searched: window name: RegmonClassJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeWindow searched: window name: FilemonClassJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeWindow searched: window name: RegmonclassJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeWindow searched: window name: FilemonclassJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeWindow searched: window name: FilemonClass
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeWindow searched: window name: RegmonClass
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeWindow searched: window name: FilemonClass
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeWindow searched: window name: Regmonclass
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeWindow searched: window name: Filemonclass
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeWindow searched: window name: FilemonClass
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeWindow searched: window name: RegmonClass
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeWindow searched: window name: FilemonClass
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeWindow searched: window name: Regmonclass
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeWindow searched: window name: Filemonclass
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeWindow searched: window name: Regmonclass
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeWindow searched: window name: FilemonClass
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeWindow searched: window name: RegmonClass
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeWindow searched: window name: FilemonClass
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeWindow searched: window name: Regmonclass
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeWindow searched: window name: Filemonclass
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeWindow searched: window name: Regmonclass
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeWindow searched: window name: FilemonClass
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeWindow searched: window name: RegmonClass
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeWindow searched: window name: FilemonClass
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeWindow searched: window name: Regmonclass
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeWindow searched: window name: Filemonclass
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeWindow searched: window name: Regmonclass
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeWindow searched: window name: FilemonClass
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeWindow searched: window name: RegmonClass
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeWindow searched: window name: FilemonClass
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeWindow searched: window name: FilemonClass
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeWindow searched: window name: RegmonClass
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeWindow searched: window name: FilemonClass
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeWindow searched: window name: Regmonclass
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeWindow searched: window name: Filemonclass
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeWindow searched: window name: FilemonClass
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeWindow searched: window name: RegmonClass
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeWindow searched: window name: FilemonClass
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeWindow searched: window name: Regmonclass
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeWindow searched: window name: Filemonclass
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeWindow searched: window name: FilemonClass
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeWindow searched: window name: RegmonClass
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeWindow searched: window name: FilemonClass
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeWindow searched: window name: Regmonclass
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeWindow searched: window name: Filemonclass
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeWindow searched: window name: Regmonclass
                            Source: C:\Users\user\Desktop\file.exeFile created: C:\Windows\Tasks\skotes.jobJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cf4bd6029c.exeJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cf4bd6029c.exeJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 05c06146f2.exeJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 05c06146f2.exeJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 959ae18948.exeJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 959ae18948.exeJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run caf9f1bef3.exeJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run caf9f1bef3.exeJump to behavior
                            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\System32\dxdiag.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\System32\dxdiag.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\System32\dxdiag.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\System32\taskkill.exeProcess information set: NOOPENFILEERRORBOX
                            Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOX

                            Malware Analysis System Evasion

                            barindex
                            Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
                            Source: C:\Users\user\Desktop\file.exeEvasive API call chain: GetPEB, DecisionNodes, ExitProcessgraph_1-12229
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeEvasive API call chain: GetPEB, DecisionNodes, ExitProcessgraph_2-9659
                            Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
                            Source: C:\Windows\System32\dxdiag.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : ASSOCIATORS OF {Win32_DiskPartition.DeviceID=&quot;Disk #0, Partition #1&quot;} WHERE ResultClass = Win32_DiskDrive
                            Source: C:\Windows\System32\dxdiag.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_DiskDriveToDiskPartition where Dependent=&quot;Win32_DiskPartition.DeviceID=\&quot;Disk #0, Partition #1\&quot;&quot;
                            Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
                            Source: C:\Windows\System32\dxdiag.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_LogicalDisk Where DriveType=3
                            Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
                            Query firmware table information (likely to detect VMs)
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeSystem information queried: FirmwareTableInformation
                            Source: C:\Windows\System32\dxdiag.exeSystem information queried: FirmwareTableInformation
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSystem information queried: FirmwareTableInformation
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSystem information queried: FirmwareTableInformation
                            Tries to detect sandboxes / dynamic malware analysis system (registry check)
                            Source: C:\Users\user\Desktop\file.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
                            Source: C:\Users\user\Desktop\file.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeFile opened: HKEY_CURRENT_USER\Software\Wine
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeFile opened: HKEY_CURRENT_USER\Software\Wine
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: HKEY_CURRENT_USER\Software\Wine
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile opened: HKEY_CURRENT_USER\Software\Wine
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: HKEY_CURRENT_USER\Software\Wine
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeFile opened: HKEY_CURRENT_USER\Software\Wine
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile opened: HKEY_CURRENT_USER\Software\Wine
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeFile opened: HKEY_CURRENT_USER\Software\Wine
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                            Tries to detect virtualization through RDTSC time measurements
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 63F346 second address: 63F34C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7ABA8E second address: 7ABABC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF63516ECB2h 0x00000007 push eax 0x00000008 pushad 0x00000009 popad 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jne 00007FF63516ECAEh 0x00000015 push ecx 0x00000016 pushad 0x00000017 popad 0x00000018 pop ecx 0x00000019 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7ABABC second address: 7ABAC7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edi 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7BCEE1 second address: 7BCEFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FF63516ECA6h 0x0000000a pop eax 0x0000000b jmp 00007FF63516ECABh 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7BCEFB second address: 7BCF05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FF634B8A936h 0x0000000a rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7BD313 second address: 7BD317 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7ABAB2 second address: 7ABABC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ecx 0x0000000a rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7BD754 second address: 7BD758 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7BD758 second address: 7BD75E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7BFE0A second address: 7BFE0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7BFE0E second address: 7BFE14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7C022A second address: 7C0230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7DE963 second address: 7DE96D instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF634B8A936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7DE96D second address: 7DE973 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7DE973 second address: 7DE986 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007FF634B8A950h 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7DEC36 second address: 7DEC43 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pop esi 0x0000000d rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7DF0FD second address: 7DF10B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FF634B8A93Ah 0x0000000a rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7DF10B second address: 7DF110 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7DF292 second address: 7DF29B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7DF54A second address: 7DF54E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7DF7FE second address: 7DF802 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7B0C62 second address: 7B0C8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jne 00007FF63516ECB2h 0x0000000b pop edx 0x0000000c pushad 0x0000000d pushad 0x0000000e jbe 00007FF63516ECA6h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 push edi 0x00000018 jg 00007FF63516ECA6h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7DFFD5 second address: 7DFFDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7DFFDB second address: 7DFFDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7E0250 second address: 7E0258 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7E0258 second address: 7E025C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7A6A1C second address: 7A6A2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF634B8A93Ah 0x00000009 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7A6A2A second address: 7A6A44 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF63516ECB6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7A6A44 second address: 7A6A52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7A6A52 second address: 7A6A56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7A6A56 second address: 7A6A72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF634B8A948h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7E69A0 second address: 7E69B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF63516ECABh 0x0000000c rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7E69B2 second address: 7E69B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EC160 second address: 7EC164 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EC164 second address: 7EC16C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EC16C second address: 7EC171 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EC431 second address: 7EC44E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FF634B8A944h 0x0000000e rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EC44E second address: 7EC46C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF63516ECB2h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EC8E4 second address: 7EC8F4 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF634B8A942h 0x00000008 jnl 00007FF634B8A936h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EC8F4 second address: 7EC8FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EEEED second address: 7EEF0A instructions: 0x00000000 rdtsc 0x00000002 js 00007FF634B8A936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007FF634B8A938h 0x00000010 popad 0x00000011 push eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jnp 00007FF634B8A936h 0x0000001b rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EEF0A second address: 7EEF15 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EEFE3 second address: 7EEFE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EEFE8 second address: 7EEFEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EF0B9 second address: 7EF0BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EF0BD second address: 7EF0C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EF0C3 second address: 7EF0C8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EF1A4 second address: 7EF1C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007FF63516ECB7h 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EF601 second address: 7EF630 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF634B8A942h 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007FF634B8A940h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EF630 second address: 7EF634 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EF6AA second address: 7EF6AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EF6AE second address: 7EF6B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EF776 second address: 7EF77A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EF77A second address: 7EF791 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FF63516ECAAh 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EF791 second address: 7EF795 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EF944 second address: 7EF95F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF63516ECB6h 0x00000009 popad 0x0000000a rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EFA6E second address: 7EFA73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7F2928 second address: 7F292C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7F292C second address: 7F298A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FF634B8A93Ch 0x0000000c jng 00007FF634B8A936h 0x00000012 popad 0x00000013 mov dword ptr [esp], eax 0x00000016 jng 00007FF634B8A93Ch 0x0000001c add esi, dword ptr [ebp+122D3AE1h] 0x00000022 push 00000000h 0x00000024 or di, A062h 0x00000029 push 00000000h 0x0000002b push edx 0x0000002c mov dword ptr [ebp+122D2653h], eax 0x00000032 pop edi 0x00000033 xchg eax, ebx 0x00000034 push edx 0x00000035 jmp 00007FF634B8A93Fh 0x0000003a pop edx 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007FF634B8A946h 0x00000043 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7F3459 second address: 7F34C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 push eax 0x00000007 jmp 00007FF63516ECAAh 0x0000000c nop 0x0000000d jmp 00007FF63516ECB4h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007FF63516ECA8h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 00000014h 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push edx 0x00000033 call 00007FF63516ECA8h 0x00000038 pop edx 0x00000039 mov dword ptr [esp+04h], edx 0x0000003d add dword ptr [esp+04h], 00000015h 0x00000045 inc edx 0x00000046 push edx 0x00000047 ret 0x00000048 pop edx 0x00000049 ret 0x0000004a xor edi, dword ptr [ebp+122D3941h] 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 popad 0x00000057 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7F3245 second address: 7F3256 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF634B8A93Dh 0x00000009 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7F34C9 second address: 7F34CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7F34CD second address: 7F34D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7F4A99 second address: 7F4AA6 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF63516ECA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7F7159 second address: 7F715E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7F715E second address: 7F7164 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7F5D47 second address: 7F5D5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF634B8A943h 0x00000009 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7F51F6 second address: 7F51FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7F7164 second address: 7F716A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7F51FA second address: 7F51FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7A858C second address: 7A8592 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7FABB1 second address: 7FABB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7FABB5 second address: 7FABD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF634B8A93Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF634B8A93Ah 0x00000012 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7FDCD1 second address: 7FDCDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7FEC3B second address: 7FEC45 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF634B8A936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7FDCDC second address: 7FDCE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 803B45 second address: 803B4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 804C41 second address: 804C45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 804C45 second address: 804C4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 802C01 second address: 802C05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 804EA4 second address: 804EA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 802C05 second address: 802C0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 804EA8 second address: 804EAE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 802C0B second address: 802C0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 805E66 second address: 805E6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 804EAE second address: 804EBC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 806A97 second address: 806AA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 804EBC second address: 804EC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7B277D second address: 7B278C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF634B8A93Bh 0x00000009 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8105AE second address: 8105B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8105B4 second address: 8105CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jmp 00007FF634B8A93Ch 0x0000000b ja 00007FF634B8A936h 0x00000011 pop esi 0x00000012 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8105CD second address: 8105DD instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF63516ECB2h 0x00000008 je 00007FF63516ECA6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 81072A second address: 81073A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jnl 00007FF634B8A936h 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 810872 second address: 810878 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 810878 second address: 810882 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 810882 second address: 810899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF63516ECB3h 0x00000009 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 810899 second address: 8108B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jns 00007FF634B8A93Eh 0x0000000e popad 0x0000000f pushad 0x00000010 push esi 0x00000011 pushad 0x00000012 popad 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8108B9 second address: 8108CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF63516ECB2h 0x00000009 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 815F06 second address: 815F29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF634B8A942h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007FF634B8A938h 0x00000014 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 815F29 second address: 815F2E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 815F2E second address: 815F3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 815F3D second address: 815F4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007FF63516ECA6h 0x0000000d rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 81601D second address: 816047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jnc 00007FF634B8A943h 0x00000010 mov eax, dword ptr [eax] 0x00000012 jbe 00007FF634B8A940h 0x00000018 pushad 0x00000019 push esi 0x0000001a pop esi 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 81BC1D second address: 81BC25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 81BC25 second address: 81BC35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FF634B8A936h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 81BC35 second address: 81BC3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 81BC3B second address: 81BC3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7AD66F second address: 7AD675 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 81B526 second address: 81B52E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 81B52E second address: 81B533 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 81B6B5 second address: 81B6BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 81B6BA second address: 81B6BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 81B94C second address: 81B965 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FF634B8A936h 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push ebx 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 821297 second address: 82129D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 82129D second address: 8212B1 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF634B8A936h 0x00000008 jg 00007FF634B8A936h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8212B1 second address: 8212B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8212B7 second address: 8212BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8212BB second address: 8212BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7B7964 second address: 7B7968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7B7968 second address: 7B7989 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF63516ECA8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f jc 00007FF63516ECA6h 0x00000015 jne 00007FF63516ECA6h 0x0000001b popad 0x0000001c push edi 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7B7989 second address: 7B7990 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edi 0x00000007 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 820316 second address: 82031A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 82031A second address: 820320 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 820320 second address: 82032A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 82072B second address: 82072F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 82072F second address: 820739 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 820739 second address: 820743 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FF634B8A936h 0x0000000a rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 820743 second address: 820765 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c jmp 00007FF63516ECB6h 0x00000011 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 820765 second address: 820772 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 81FDAD second address: 81FDC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FF63516ECB0h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 820CC4 second address: 820CDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FF634B8A936h 0x0000000a jns 00007FF634B8A936h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jns 00007FF634B8A936h 0x00000019 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 820CDD second address: 820CE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 824737 second address: 82473D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 82473D second address: 82476A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jbe 00007FF63516ECC5h 0x0000000e rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 82476A second address: 8247A2 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF634B8A94Eh 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FF634B8A946h 0x0000000f jno 00007FF634B8A93Ch 0x00000015 pop edx 0x00000016 pop eax 0x00000017 jne 00007FF634B8A964h 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7ED7F2 second address: 7ED7F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7ED945 second address: 7ED994 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF634B8A942h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push ecx 0x0000000e jmp 00007FF634B8A93Ch 0x00000013 pop ecx 0x00000014 mov eax, dword ptr [eax] 0x00000016 pushad 0x00000017 pushad 0x00000018 jmp 00007FF634B8A942h 0x0000001d push esi 0x0000001e pop esi 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FF634B8A93Ch 0x00000027 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EDA58 second address: 7EDA5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EDC18 second address: 7EDC1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EDC1E second address: 7EDC22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EDC22 second address: 7EDC4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jo 00007FF634B8A936h 0x00000013 popad 0x00000014 pop ebx 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FF634B8A93Dh 0x00000020 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EDC4A second address: 7EDC76 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF63516ECA8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c jmp 00007FF63516ECB0h 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 je 00007FF63516ECB0h 0x0000001b push eax 0x0000001c push edx 0x0000001d push edx 0x0000001e pop edx 0x0000001f rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EDE4A second address: 7EDE5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 pushad 0x00000007 jp 00007FF634B8A938h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EDE5D second address: 7EDE9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF63516ECB5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b mov ch, bh 0x0000000d push 00000004h 0x0000000f mov di, bx 0x00000012 push eax 0x00000013 pushad 0x00000014 jmp 00007FF63516ECB8h 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EDE9D second address: 7EDEA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EE287 second address: 7EE294 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007FF63516ECA6h 0x0000000d rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EE294 second address: 7EE298 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EE620 second address: 7EE65D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FF63516ECA6h 0x00000009 jmp 00007FF63516ECADh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 nop 0x00000012 call 00007FF63516ECAEh 0x00000017 pop ecx 0x00000018 lea eax, dword ptr [ebp+12482145h] 0x0000001e mov di, dx 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 js 00007FF63516ECA6h 0x0000002c rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EE65D second address: 7EE667 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF634B8A936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EE667 second address: 7EE698 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF63516ECAEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c or dword ptr [ebp+122D1EBCh], edi 0x00000012 lea eax, dword ptr [ebp+12482101h] 0x00000018 sub dword ptr [ebp+122D3552h], ecx 0x0000001e nop 0x0000001f jns 00007FF63516ECAEh 0x00000025 push esi 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EE698 second address: 7EE6A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EE6A3 second address: 7EE6A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EE6A7 second address: 7D45D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 nop 0x00000008 call dword ptr [ebp+122D203Dh] 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FF634B8A947h 0x00000016 je 00007FF634B8A936h 0x0000001c rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7D45D6 second address: 7D4601 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FF63516ECB7h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 jc 00007FF63516ECB2h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7D4601 second address: 7D4607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 824A8C second address: 824A9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF63516ECABh 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 824A9D second address: 824AA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 824AA5 second address: 824AF0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FF63516ECB7h 0x0000000c jmp 00007FF63516ECB1h 0x00000011 jmp 00007FF63516ECB3h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push ecx 0x0000001e pop ecx 0x0000001f rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 824AF0 second address: 824B00 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007FF634B8A936h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 824B00 second address: 824B16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF63516ECACh 0x00000007 jl 00007FF63516ECA6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 824C89 second address: 824C8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 824C8D second address: 824CA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF63516ECB6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 824CA9 second address: 824CB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jc 00007FF634B8A936h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 824CB6 second address: 824D07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FF63516ECA6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jo 00007FF63516ECEEh 0x00000013 jmp 00007FF63516ECAFh 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FF63516ECB8h 0x0000001f jmp 00007FF63516ECB5h 0x00000024 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 824D07 second address: 824D0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 824E6A second address: 824E74 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 824E74 second address: 824E7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 824E7A second address: 824E7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 824E7E second address: 824E86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 824E86 second address: 824E8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 824E8B second address: 824E95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 824E95 second address: 824EA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 825001 second address: 825005 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 825005 second address: 82500B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 82BCF6 second address: 82BCFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 82BCFC second address: 82BD12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF63516ECB0h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 831594 second address: 8315AC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007FF634B8A936h 0x00000012 jbe 00007FF634B8A936h 0x00000018 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8315AC second address: 8315CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FF63516ECB3h 0x00000011 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 830430 second address: 830434 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 830557 second address: 830574 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF63516ECB2h 0x00000008 pushad 0x00000009 je 00007FF63516ECA6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8307EB second address: 8307F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FF634B8A936h 0x0000000a rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 830A72 second address: 830A80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007FF63516ECA6h 0x0000000e rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 830A80 second address: 830A84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 830A84 second address: 830A8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 830E89 second address: 830E9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF634B8A93Bh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 830E9D second address: 830EA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 830EA1 second address: 830EB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FF634B8A936h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007FF634B8A936h 0x00000014 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 83142D second address: 831431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 831431 second address: 831435 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 831435 second address: 831446 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 jc 00007FF63516ECA6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 831446 second address: 831450 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 836934 second address: 836938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 836938 second address: 836967 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF634B8A946h 0x00000007 jmp 00007FF634B8A945h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 839CD0 second address: 839CD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8395A5 second address: 8395B5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF634B8A936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e pop eax 0x0000000f popad 0x00000010 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8398A8 second address: 8398D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FF63516ECA6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007FF63516ECAAh 0x00000015 push edx 0x00000016 pop edx 0x00000017 popad 0x00000018 push ebx 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b jc 00007FF63516ECA6h 0x00000021 pop ebx 0x00000022 pushad 0x00000023 push ebx 0x00000024 pop ebx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8398D4 second address: 8398DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 839A5F second address: 839A6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 83E8D8 second address: 83E8DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 83E8DE second address: 83E8EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF63516ECAAh 0x00000009 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 844A87 second address: 844ABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF634B8A943h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF634B8A946h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 844ABB second address: 844AC5 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF63516ECA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 844AC5 second address: 844AF2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF634B8A949h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007FF634B8A93Eh 0x00000011 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 844AF2 second address: 844AFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jns 00007FF63516ECA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 843379 second address: 84339E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF634B8A93Ah 0x00000007 jmp 00007FF634B8A942h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e popad 0x0000000f pushad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 84339E second address: 8433A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 843668 second address: 843672 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF634B8A942h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8437B2 second address: 8437B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8437B7 second address: 8437BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8437BD second address: 8437C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 843906 second address: 84390B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EE038 second address: 7EE03C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EE03C second address: 7EE05C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF634B8A948h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EE05C second address: 7EE060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EE060 second address: 7EE0D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007FF634B8A938h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 0000001Dh 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 and edx, 551BE54Fh 0x0000002a mov ebx, dword ptr [ebp+12482140h] 0x00000030 push 00000000h 0x00000032 push edi 0x00000033 call 00007FF634B8A938h 0x00000038 pop edi 0x00000039 mov dword ptr [esp+04h], edi 0x0000003d add dword ptr [esp+04h], 00000018h 0x00000045 inc edi 0x00000046 push edi 0x00000047 ret 0x00000048 pop edi 0x00000049 ret 0x0000004a mov dword ptr [ebp+122D2047h], ecx 0x00000050 add eax, ebx 0x00000052 push eax 0x00000053 pushad 0x00000054 jnc 00007FF634B8A93Ch 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d pop eax 0x0000005e rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 7EE0D5 second address: 7EE12C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF63516ECB3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007FF63516ECA8h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 mov edx, dword ptr [ebp+122D2980h] 0x0000002d push 00000004h 0x0000002f mov dword ptr [ebp+124764B0h], edi 0x00000035 nop 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 push eax 0x0000003a pop eax 0x0000003b pushad 0x0000003c popad 0x0000003d popad 0x0000003e rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 844771 second address: 8447AF instructions: 0x00000000 rdtsc 0x00000002 ja 00007FF634B8A936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FF634B8A944h 0x0000000f jp 00007FF634B8A94Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8447AF second address: 8447B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 84822B second address: 84822F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 84822F second address: 848235 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 848579 second address: 84857F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 84857F second address: 8485AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 jnp 00007FF63516ECA6h 0x0000000c ja 00007FF63516ECA6h 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FF63516ECB7h 0x0000001a push edi 0x0000001b pop edi 0x0000001c rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 84A297 second address: 84A2A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007FF634B8A938h 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 84A2A9 second address: 84A2C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF63516ECB6h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 84A2C7 second address: 84A2CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 852C43 second address: 852C5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FF63516ECAFh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 852C5D second address: 852C63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 852C63 second address: 852C6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FF63516ECA6h 0x0000000a popad 0x0000000b rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 851296 second address: 8512C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF634B8A93Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007FF634B8A936h 0x00000012 jmp 00007FF634B8A946h 0x00000017 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8512C8 second address: 8512D4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 851843 second address: 851847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 851847 second address: 851869 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF63516ECB7h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 851869 second address: 851873 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 851873 second address: 8518A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FF63516ECB3h 0x0000000a popad 0x0000000b jo 00007FF63516ECB8h 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 jl 00007FF63516ECACh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 851B58 second address: 851B8F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF634B8A949h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF634B8A946h 0x00000012 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 851E70 second address: 851E92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FF63516ECA6h 0x0000000a jmp 00007FF63516ECB7h 0x0000000f popad 0x00000010 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 851E92 second address: 851EA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF634B8A93Fh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 851EA6 second address: 851EAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 851EAC second address: 851EB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8520FE second address: 852103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 852103 second address: 852108 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 852108 second address: 852114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FF63516ECA6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8523E3 second address: 8523E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8523E9 second address: 8523FB instructions: 0x00000000 rdtsc 0x00000002 je 00007FF63516ECA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007FF63516ECA6h 0x00000012 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 852704 second address: 85270A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 855CFB second address: 855D01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 855E5B second address: 855E89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FF634B8A93Eh 0x0000000b jmp 00007FF634B8A946h 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 855E89 second address: 855EA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FF63516ECA6h 0x0000000a pop eax 0x0000000b je 00007FF63516ECB2h 0x00000011 jne 00007FF63516ECA6h 0x00000017 jp 00007FF63516ECA6h 0x0000001d push ecx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 855EA9 second address: 855EB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 855FF5 second address: 855FF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 855FF9 second address: 855FFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 85649D second address: 8564BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF63516ECADh 0x00000012 jbe 00007FF63516ECA6h 0x00000018 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8565FA second address: 856606 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF634B8A93Eh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 856606 second address: 856613 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 jbe 00007FF63516ECA6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 856613 second address: 856623 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007FF634B8A936h 0x00000010 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 856623 second address: 856655 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF63516ECB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FF63516ECB2h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8568E4 second address: 8568E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 864824 second address: 86482E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FF63516ECA6h 0x0000000a rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 86482E second address: 864859 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FF634B8A93Ch 0x0000000c jnl 00007FF634B8A936h 0x00000012 push eax 0x00000013 push edx 0x00000014 jc 00007FF634B8A947h 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c jmp 00007FF634B8A93Fh 0x00000021 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 864859 second address: 864861 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 864861 second address: 864865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 864865 second address: 864869 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 863097 second address: 86309C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8634A6 second address: 8634AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 86840F second address: 868415 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 868415 second address: 868446 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF63516ECB4h 0x00000007 jnc 00007FF63516ECB5h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 868446 second address: 86846F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF634B8A947h 0x00000009 jc 00007FF634B8A936h 0x0000000f popad 0x00000010 push ecx 0x00000011 pushad 0x00000012 popad 0x00000013 pop ecx 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 86846F second address: 868475 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 868475 second address: 86847E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 87A87D second address: 87A886 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 87E151 second address: 87E161 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007FF634B8A936h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 87E161 second address: 87E171 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 87FB04 second address: 87FB10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FF634B8A936h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 87FB10 second address: 87FB22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push esi 0x00000009 pop esi 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d push ecx 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 87FB22 second address: 87FB3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 pushad 0x00000007 jmp 00007FF634B8A941h 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 885D92 second address: 885DA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF63516ECB3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 888BDA second address: 888BFC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jns 00007FF634B8A936h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FF634B8A946h 0x00000011 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 888BFC second address: 888C1C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FF63516ECB7h 0x00000008 pop edx 0x00000009 push ebx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 88A461 second address: 88A465 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 892F1A second address: 892F37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF63516ECB9h 0x00000009 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 89BA6A second address: 89BA76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FF634B8A942h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 89BA76 second address: 89BA7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 89BBCC second address: 89BC11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FF634B8A942h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007FF634B8A943h 0x00000013 jmp 00007FF634B8A943h 0x00000018 popad 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 89BC11 second address: 89BC1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FF63516ECA6h 0x0000000a pop edx 0x0000000b rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 89BC1C second address: 89BC2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FF634B8A936h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 89C048 second address: 89C04F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 89C1C3 second address: 89C1D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 js 00007FF634B8A942h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 89C1D1 second address: 89C1D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 89C1D7 second address: 89C1DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 89C356 second address: 89C379 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FF63516ECAAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FF63516ECABh 0x00000010 push eax 0x00000011 push edx 0x00000012 ja 00007FF63516ECA6h 0x00000018 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 89C379 second address: 89C37F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 89CE58 second address: 89CE6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FF63516ECADh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 89CE6E second address: 89CE73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 89FD62 second address: 89FD66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 89FD66 second address: 89FDA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF634B8A949h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jmp 00007FF634B8A93Fh 0x00000010 jno 00007FF634B8A936h 0x00000016 push edi 0x00000017 pop edi 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a popad 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e pushad 0x0000001f popad 0x00000020 push ecx 0x00000021 pop ecx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 89FDA8 second address: 89FDBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007FF63516ECB2h 0x0000000b jne 00007FF63516ECA6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8B2FC4 second address: 8B2FC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8B2FC8 second address: 8B2FF7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF63516ECB8h 0x00000007 jmp 00007FF63516ECADh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8B2FF7 second address: 8B3019 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FF634B8A936h 0x0000000a popad 0x0000000b jmp 00007FF634B8A947h 0x00000010 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8B480F second address: 8B4813 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8B4813 second address: 8B481C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8B481C second address: 8B482B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007FF63516ECA6h 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8B482B second address: 8B4832 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8AE29A second address: 8AE2B7 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF63516ECA6h 0x00000008 jno 00007FF63516ECA6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FF63516ECABh 0x00000017 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8C1D81 second address: 8C1D92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF634B8A93Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8C1A8E second address: 8C1A94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8C1A94 second address: 8C1AC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF634B8A940h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FF634B8A946h 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8DB812 second address: 8DB818 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8DAC0F second address: 8DAC1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FF634B8A936h 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8DAC1B second address: 8DAC1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8DAEFA second address: 8DAF00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8DB046 second address: 8DB04B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8DB04B second address: 8DB051 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8DB051 second address: 8DB057 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8DB201 second address: 8DB205 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8DB205 second address: 8DB21C instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF63516ECA6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8DB21C second address: 8DB236 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007FF634B8A936h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007FF634B8A936h 0x00000014 jbe 00007FF634B8A936h 0x0000001a rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8DE1D1 second address: 8DE1DB instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF63516ECACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8DE275 second address: 8DE27B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8DE4C3 second address: 8DE4D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF63516ECB2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8DE739 second address: 8DE74E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF634B8A940h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8DE74E second address: 8DE760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007FF63516ECACh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8DE760 second address: 8DE764 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8DE764 second address: 8DE769 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8DE769 second address: 8DE76F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8DE76F second address: 8DE7BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov dword ptr [ebp+12455FD4h], eax 0x0000000e push dword ptr [ebp+122D2A5Ah] 0x00000014 mov edx, edi 0x00000016 call 00007FF63516ECA9h 0x0000001b jmp 00007FF63516ECB0h 0x00000020 push eax 0x00000021 jns 00007FF63516ECAEh 0x00000027 mov eax, dword ptr [esp+04h] 0x0000002b pushad 0x0000002c pushad 0x0000002d pushad 0x0000002e popad 0x0000002f jl 00007FF63516ECA6h 0x00000035 popad 0x00000036 push ebx 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8DE7BF second address: 8DE816 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 jne 00007FF634B8A945h 0x0000000f jmp 00007FF634B8A93Fh 0x00000014 jmp 00007FF634B8A949h 0x00000019 popad 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FF634B8A949h 0x00000025 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 8E322A second address: 8E3246 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF63516ECB2h 0x00000008 je 00007FF63516ECA6h 0x0000000e je 00007FF63516ECA6h 0x00000014 jl 00007FF63516ECB2h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5460E9B second address: 5460E9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5460E9F second address: 5460ECA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FF63516ECACh 0x00000011 adc ecx, 4EF5B768h 0x00000017 jmp 00007FF63516ECABh 0x0000001c popfd 0x0000001d popad 0x0000001e rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5460ECA second address: 5460F06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF634B8A949h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF634B8A948h 0x00000015 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5460F06 second address: 5460F0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5460F0A second address: 5460F10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5460F10 second address: 5460F16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 549081E second address: 5490824 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5490824 second address: 5490828 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5430073 second address: 5430090 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF634B8A949h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5430090 second address: 5430096 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5430096 second address: 54300C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF634B8A943h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF634B8A945h 0x00000013 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54300C7 second address: 5430122 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov ax, dx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FF63516ECB6h 0x00000011 xchg eax, ebp 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FF63516ECAEh 0x00000019 adc eax, 22FF90E8h 0x0000001f jmp 00007FF63516ECABh 0x00000024 popfd 0x00000025 movzx eax, dx 0x00000028 popad 0x00000029 mov ebp, esp 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FF63516ECAEh 0x00000032 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5430122 second address: 5430141 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, ebx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF634B8A942h 0x00000012 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5430141 second address: 543018B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 5FAE3454h 0x00000008 pushfd 0x00000009 jmp 00007FF63516ECADh 0x0000000e sub cx, 2716h 0x00000013 jmp 00007FF63516ECB1h 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push dword ptr [ebp+0Ch] 0x0000001f jmp 00007FF63516ECAEh 0x00000024 push dword ptr [ebp+08h] 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 543018B second address: 543018F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 543018F second address: 5430193 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5430193 second address: 5430199 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54301BD second address: 54301C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54301C1 second address: 54301C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5450BA3 second address: 5450BC8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF63516ECB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF63516ECADh 0x00000011 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5450BC8 second address: 5450C16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 461DB882h 0x00000008 push edx 0x00000009 pop ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007FF634B8A944h 0x00000013 xchg eax, ebp 0x00000014 jmp 00007FF634B8A940h 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FF634B8A947h 0x00000022 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5450C16 second address: 5450C2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF63516ECB4h 0x00000009 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 545066E second address: 54506DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF634B8A945h 0x00000009 sbb ah, FFFFFFE6h 0x0000000c jmp 00007FF634B8A941h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007FF634B8A940h 0x00000018 add cl, FFFFFF88h 0x0000001b jmp 00007FF634B8A93Bh 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 xchg eax, ebp 0x00000025 pushad 0x00000026 mov al, 88h 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FF634B8A947h 0x0000002f rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5450570 second address: 54505E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, dl 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FF63516ECAAh 0x0000000e push eax 0x0000000f pushad 0x00000010 pushad 0x00000011 call 00007FF63516ECB7h 0x00000016 pop esi 0x00000017 pushfd 0x00000018 jmp 00007FF63516ECB9h 0x0000001d or si, 8806h 0x00000022 jmp 00007FF63516ECB1h 0x00000027 popfd 0x00000028 popad 0x00000029 pushad 0x0000002a mov di, cx 0x0000002d mov eax, 7FBE5E89h 0x00000032 popad 0x00000033 popad 0x00000034 xchg eax, ebp 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007FF63516ECABh 0x0000003c rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54505E9 second address: 545062F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF634B8A942h 0x00000009 jmp 00007FF634B8A945h 0x0000000e popfd 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov ebp, esp 0x00000014 jmp 00007FF634B8A93Eh 0x00000019 pop ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 545062F second address: 5450635 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5450635 second address: 5450644 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF634B8A93Bh 0x00000009 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5450644 second address: 5450648 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5450284 second address: 5450288 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5450288 second address: 545028E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 545028E second address: 54502CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, E703h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esp 0x0000000b jmp 00007FF634B8A942h 0x00000010 mov dword ptr [esp], ebp 0x00000013 pushad 0x00000014 mov ax, 4A9Dh 0x00000018 push eax 0x00000019 push edx 0x0000001a call 00007FF634B8A948h 0x0000001f pop ecx 0x00000020 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54502CE second address: 545030A instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FF63516ECABh 0x00000008 and si, 8BBEh 0x0000000d jmp 00007FF63516ECB9h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b mov bx, C11Eh 0x0000001f mov esi, ebx 0x00000021 popad 0x00000022 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54600A7 second address: 54600AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54600AB second address: 54600B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54600B1 second address: 54600CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF634B8A945h 0x00000009 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54600CA second address: 54600FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF63516ECB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d movzx esi, bx 0x00000010 mov di, F95Ch 0x00000014 popad 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FF63516ECB1h 0x0000001d rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54600FF second address: 5460105 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5460105 second address: 5460109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5460109 second address: 546013A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FF634B8A93Fh 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FF634B8A945h 0x00000017 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 549074A second address: 54907C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, di 0x00000006 jmp 00007FF63516ECB3h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 jmp 00007FF63516ECAFh 0x00000015 pushfd 0x00000016 jmp 00007FF63516ECB8h 0x0000001b add cx, BD98h 0x00000020 jmp 00007FF63516ECABh 0x00000025 popfd 0x00000026 popad 0x00000027 xchg eax, ebp 0x00000028 pushad 0x00000029 jmp 00007FF63516ECB4h 0x0000002e mov ebx, ecx 0x00000030 popad 0x00000031 mov ebp, esp 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 push edx 0x00000037 pop esi 0x00000038 movsx ebx, ax 0x0000003b popad 0x0000003c rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54907C6 second address: 54907FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF634B8A947h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a pushad 0x0000000b call 00007FF634B8A944h 0x00000010 mov esi, 2F55EA91h 0x00000015 pop esi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5470305 second address: 547030B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 547030B second address: 547032A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF634B8A944h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop ebx 0x00000010 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 547032A second address: 5470375 instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jmp 00007FF63516ECB5h 0x0000000c popad 0x0000000d mov eax, dword ptr [ebp+08h] 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov ax, dx 0x00000016 pushfd 0x00000017 jmp 00007FF63516ECAFh 0x0000001c jmp 00007FF63516ECB3h 0x00000021 popfd 0x00000022 popad 0x00000023 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5470375 second address: 54703AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF634B8A949h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and dword ptr [eax], 00000000h 0x0000000c jmp 00007FF634B8A93Eh 0x00000011 and dword ptr [eax+04h], 00000000h 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54703AD second address: 54703B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54703B1 second address: 54703B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54703B7 second address: 54703F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF63516ECB2h 0x00000009 and al, FFFFFFE8h 0x0000000c jmp 00007FF63516ECABh 0x00000011 popfd 0x00000012 movzx esi, di 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pop ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FF63516ECAEh 0x00000020 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5450489 second address: 54504C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF634B8A941h 0x00000009 sbb ax, 33B6h 0x0000000e jmp 00007FF634B8A941h 0x00000013 popfd 0x00000014 mov ebx, eax 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54504C1 second address: 54504C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54504C5 second address: 54504C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54504C9 second address: 54504CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54504CF second address: 54504ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF634B8A941h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f mov ch, dh 0x00000011 popad 0x00000012 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54504ED second address: 545051E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, si 0x00000006 mov bx, cx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 movsx ebx, cx 0x00000014 pushfd 0x00000015 jmp 00007FF63516ECAAh 0x0000001a adc cx, BB98h 0x0000001f jmp 00007FF63516ECABh 0x00000024 popfd 0x00000025 popad 0x00000026 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5460DAD second address: 5460DDC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF634B8A942h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007FF634B8A943h 0x00000012 pop ecx 0x00000013 popad 0x00000014 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5460DDC second address: 5460E73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov si, B1B1h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FF63516ECAAh 0x00000014 jmp 00007FF63516ECB5h 0x00000019 popfd 0x0000001a push esi 0x0000001b pushfd 0x0000001c jmp 00007FF63516ECB7h 0x00000021 sbb ax, 587Eh 0x00000026 jmp 00007FF63516ECB9h 0x0000002b popfd 0x0000002c pop eax 0x0000002d popad 0x0000002e mov ebp, esp 0x00000030 jmp 00007FF63516ECB7h 0x00000035 pop ebp 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FF63516ECB0h 0x0000003f rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5460E73 second address: 5460E79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5460E79 second address: 5460E7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5470132 second address: 5470136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5470136 second address: 547013C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 547013C second address: 547015C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF634B8A93Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF634B8A93Dh 0x00000013 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 547015C second address: 5470160 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5470160 second address: 5470166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5470166 second address: 547016C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 547016C second address: 5470170 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5470170 second address: 5470180 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c mov cx, D61Dh 0x00000010 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5480DAB second address: 5480DAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5480DAF second address: 5480DB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5480DB3 second address: 5480DB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5480DB9 second address: 5480DD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF63516ECB9h 0x00000009 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5480ED4 second address: 5480EFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF634B8A947h 0x00000008 mov dx, si 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xor eax, dword ptr [ebp+08h] 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5480EFD second address: 5480F01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5480F01 second address: 5480F07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5480F07 second address: 5480F0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5480F0D second address: 5480F11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5480F11 second address: 5480F32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and ecx, 1Fh 0x0000000b pushad 0x0000000c call 00007FF63516ECB3h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5480F32 second address: 5480F63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov edx, 157C807Ah 0x0000000a popad 0x0000000b ror eax, cl 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FF634B8A93Ah 0x00000016 sub eax, 5A45C7B8h 0x0000001c jmp 00007FF634B8A93Bh 0x00000021 popfd 0x00000022 mov dx, si 0x00000025 popad 0x00000026 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5480F63 second address: 5480F6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5480F6A second address: 5480F8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 leave 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FF634B8A946h 0x0000000f rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5480F8A second address: 5480F90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5480F90 second address: 5480F94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5480F94 second address: 549001E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 retn 0004h 0x0000000b nop 0x0000000c mov esi, eax 0x0000000e lea eax, dword ptr [ebp-08h] 0x00000011 xor esi, dword ptr [00632014h] 0x00000017 push eax 0x00000018 push eax 0x00000019 push eax 0x0000001a lea eax, dword ptr [ebp-10h] 0x0000001d push eax 0x0000001e call 00007FF63A00EBE6h 0x00000023 push FFFFFFFEh 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 call 00007FF63516ECB2h 0x0000002d pop eax 0x0000002e mov ebx, 7E590666h 0x00000033 popad 0x00000034 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 549001E second address: 5490024 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5490024 second address: 5490028 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5490028 second address: 5490037 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5490037 second address: 549003B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 549003B second address: 5490052 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF634B8A943h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5490052 second address: 549007D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF63516ECB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ret 0x0000000a nop 0x0000000b push eax 0x0000000c call 00007FF63A00EC4Fh 0x00000011 mov edi, edi 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov edi, 7B6396FEh 0x0000001b mov esi, edx 0x0000001d popad 0x0000001e rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 549007D second address: 54900D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF634B8A93Eh 0x00000009 jmp 00007FF634B8A945h 0x0000000e popfd 0x0000000f call 00007FF634B8A940h 0x00000014 pop eax 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push esi 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FF634B8A948h 0x00000022 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54900D6 second address: 54900E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF63516ECABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54900E5 second address: 549010B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF634B8A949h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 549010B second address: 5490111 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5490111 second address: 5490126 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF634B8A941h 0x00000009 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 544006B second address: 5440071 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5440071 second address: 544008A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF634B8A93Ch 0x00000012 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 544008A second address: 5440090 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5440090 second address: 5440096 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5440096 second address: 544009A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 544009A second address: 54400BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FF634B8A944h 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop edx 0x00000015 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54400BE second address: 54400F9 instructions: 0x00000000 rdtsc 0x00000002 call 00007FF63516ECB8h 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov bx, C7D6h 0x0000000e popad 0x0000000f and esp, FFFFFFF8h 0x00000012 jmp 00007FF63516ECADh 0x00000017 xchg eax, ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d push edi 0x0000001e pop esi 0x0000001f popad 0x00000020 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54400F9 second address: 544010E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF634B8A941h 0x00000009 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 544010E second address: 5440112 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5440112 second address: 5440130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FF634B8A943h 0x00000010 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5440130 second address: 5440153 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF63516ECB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5440153 second address: 5440159 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5440159 second address: 544015E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 544015E second address: 54401A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, D0h 0x00000005 mov bx, 6F32h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007FF634B8A946h 0x00000012 mov dword ptr [esp], ebx 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushfd 0x00000019 jmp 00007FF634B8A93Ch 0x0000001e sbb cx, 3F78h 0x00000023 jmp 00007FF634B8A93Bh 0x00000028 popfd 0x00000029 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54401A5 second address: 544021A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF63516ECB8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007FF63516ECB2h 0x0000000f sub eax, 1EF76908h 0x00000015 jmp 00007FF63516ECABh 0x0000001a popfd 0x0000001b popad 0x0000001c mov ebx, dword ptr [ebp+10h] 0x0000001f jmp 00007FF63516ECB6h 0x00000024 xchg eax, esi 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FF63516ECB7h 0x0000002c rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 544021A second address: 5440255 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF634B8A949h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov dl, DDh 0x0000000d mov ecx, 52DCFE2Fh 0x00000012 popad 0x00000013 xchg eax, esi 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FF634B8A941h 0x0000001b rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5440255 second address: 54402C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF63516ECB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d jmp 00007FF63516ECACh 0x00000012 call 00007FF63516ECB2h 0x00000017 mov eax, 6B61A701h 0x0000001c pop eax 0x0000001d popad 0x0000001e push ecx 0x0000001f jmp 00007FF63516ECAAh 0x00000024 mov dword ptr [esp], edi 0x00000027 jmp 00007FF63516ECB0h 0x0000002c test esi, esi 0x0000002e pushad 0x0000002f mov si, 131Dh 0x00000033 popad 0x00000034 je 00007FF6A73CD002h 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f popad 0x00000040 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54402C5 second address: 54402CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54402CB second address: 5440386 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FF63516ECB9h 0x00000008 pop esi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c cmp dword ptr [esi+08h], DDEEDDEEh 0x00000013 jmp 00007FF63516ECAAh 0x00000018 je 00007FF6A73CCFD5h 0x0000001e jmp 00007FF63516ECB0h 0x00000023 mov edx, dword ptr [esi+44h] 0x00000026 jmp 00007FF63516ECB0h 0x0000002b or edx, dword ptr [ebp+0Ch] 0x0000002e jmp 00007FF63516ECB0h 0x00000033 test edx, 61000000h 0x00000039 pushad 0x0000003a mov eax, edx 0x0000003c popad 0x0000003d jne 00007FF6A73CCFECh 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 call 00007FF63516ECB0h 0x0000004b pop eax 0x0000004c pushfd 0x0000004d jmp 00007FF63516ECABh 0x00000052 adc ch, 0000000Eh 0x00000055 jmp 00007FF63516ECB9h 0x0000005a popfd 0x0000005b popad 0x0000005c rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5440386 second address: 5440396 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF634B8A93Ch 0x00000009 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5440396 second address: 54403F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF63516ECABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test byte ptr [esi+48h], 00000001h 0x0000000f jmp 00007FF63516ECB6h 0x00000014 jne 00007FF6A73CCF86h 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007FF63516ECADh 0x00000023 xor si, 0356h 0x00000028 jmp 00007FF63516ECB1h 0x0000002d popfd 0x0000002e popad 0x0000002f rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54307BD second address: 54307C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54307C1 second address: 54307C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54307C7 second address: 54307E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF634B8A93Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54307E0 second address: 54307E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54307E6 second address: 54307EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54307EC second address: 54307F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54307F0 second address: 5430844 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF634B8A941h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FF634B8A93Eh 0x00000011 mov ebp, esp 0x00000013 jmp 00007FF634B8A940h 0x00000018 and esp, FFFFFFF8h 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FF634B8A947h 0x00000022 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5430A27 second address: 5430AB8 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FF63516ECAAh 0x00000008 and ax, 11C8h 0x0000000d jmp 00007FF63516ECABh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 je 00007FF6A73D4601h 0x0000001c jmp 00007FF63516ECB6h 0x00000021 test byte ptr [77726968h], 00000002h 0x00000028 pushad 0x00000029 mov bl, ch 0x0000002b jmp 00007FF63516ECB3h 0x00000030 popad 0x00000031 jne 00007FF6A73D45DAh 0x00000037 jmp 00007FF63516ECB6h 0x0000003c mov edx, dword ptr [ebp+0Ch] 0x0000003f jmp 00007FF63516ECB0h 0x00000044 xchg eax, ebx 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5430AB8 second address: 5430ABC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5430ABC second address: 5430AC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5430AC0 second address: 5430AC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5430AC6 second address: 5430B82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF63516ECB4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FF63516ECABh 0x0000000f xchg eax, ebx 0x00000010 pushad 0x00000011 push ecx 0x00000012 call 00007FF63516ECABh 0x00000017 pop eax 0x00000018 pop ebx 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007FF63516ECB4h 0x00000020 sub ax, 20D8h 0x00000025 jmp 00007FF63516ECABh 0x0000002a popfd 0x0000002b pushfd 0x0000002c jmp 00007FF63516ECB8h 0x00000031 adc al, 00000038h 0x00000034 jmp 00007FF63516ECABh 0x00000039 popfd 0x0000003a popad 0x0000003b popad 0x0000003c xchg eax, ebx 0x0000003d pushad 0x0000003e movzx eax, bx 0x00000041 pushfd 0x00000042 jmp 00007FF63516ECB1h 0x00000047 sub esi, 67A631D6h 0x0000004d jmp 00007FF63516ECB1h 0x00000052 popfd 0x00000053 popad 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a popad 0x0000005b rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5430B82 second address: 5430B88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5440D1F second address: 5440D25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5440A43 second address: 5440AA4 instructions: 0x00000000 rdtsc 0x00000002 mov ax, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushfd 0x00000008 jmp 00007FF634B8A945h 0x0000000d sbb ch, 00000066h 0x00000010 jmp 00007FF634B8A941h 0x00000015 popfd 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 jmp 00007FF634B8A93Eh 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 mov edx, ecx 0x00000023 jmp 00007FF634B8A948h 0x00000028 popad 0x00000029 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5440AA4 second address: 5440ABA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF63516ECABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5440ABA second address: 5440ABE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5440ABE second address: 5440AC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54B0A89 second address: 54B0A8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54B0A8D second address: 54B0A9F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF63516ECAEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54B0A9F second address: 54B0B24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF634B8A941h 0x00000009 add eax, 4DB1C8D6h 0x0000000f jmp 00007FF634B8A941h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007FF634B8A940h 0x0000001b or ch, FFFFFFF8h 0x0000001e jmp 00007FF634B8A93Bh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 xchg eax, ebp 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007FF634B8A944h 0x0000002f sbb eax, 4F896958h 0x00000035 jmp 00007FF634B8A93Bh 0x0000003a popfd 0x0000003b mov ch, 7Eh 0x0000003d popad 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 mov ch, dh 0x00000044 push ecx 0x00000045 pop edx 0x00000046 popad 0x00000047 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54B0B24 second address: 54B0B65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF63516ECB5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FF63516ECAEh 0x0000000f mov ebp, esp 0x00000011 jmp 00007FF63516ECB0h 0x00000016 pop ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54B0B65 second address: 54B0B69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54B0B69 second address: 54B0B6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54B0B6D second address: 54B0B73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54B002C second address: 54B0032 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54A0E3A second address: 54A0E4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF634B8A93Eh 0x00000009 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54A0E4C second address: 54A0E50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5450090 second address: 5450096 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54B02C9 second address: 54B02CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54B02CF second address: 54B02D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54B02D5 second address: 54B02D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54B02D9 second address: 54B02DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54B02DD second address: 54B02EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54B02EC second address: 54B02F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54B02F2 second address: 54B033B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF63516ECB3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FF63516ECB6h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FF63516ECB7h 0x00000018 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54B033B second address: 54B0341 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54B0341 second address: 54B037D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+0Ch] 0x0000000b jmp 00007FF63516ECB7h 0x00000010 push dword ptr [ebp+08h] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FF63516ECB5h 0x0000001a rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54603E0 second address: 546045B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF634B8A93Fh 0x00000009 add ah, 0000000Eh 0x0000000c jmp 00007FF634B8A949h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007FF634B8A940h 0x00000018 add ax, D388h 0x0000001d jmp 00007FF634B8A93Bh 0x00000022 popfd 0x00000023 popad 0x00000024 pop edx 0x00000025 pop eax 0x00000026 call 00007FF634B8A939h 0x0000002b jmp 00007FF634B8A946h 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 546045B second address: 546045F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 546045F second address: 5460465 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5460465 second address: 546049E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF63516ECAFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007FF63516ECB9h 0x00000012 mov eax, dword ptr [eax] 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 mov di, 1990h 0x0000001b rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 546049E second address: 54604B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bx, ax 0x00000007 popad 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF634B8A93Ch 0x00000013 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54604B8 second address: 54604BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54604BE second address: 54604C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54604C2 second address: 54604DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF63516ECABh 0x00000012 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54604DA second address: 54604DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54604DE second address: 54604E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54604E4 second address: 54604EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54604EA second address: 54604EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54604EE second address: 5460567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 17A3124Dh 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FF634B8A949h 0x00000014 add esi, 7A3D46D6h 0x0000001a jmp 00007FF634B8A941h 0x0000001f popfd 0x00000020 push esi 0x00000021 pushad 0x00000022 popad 0x00000023 pop ebx 0x00000024 popad 0x00000025 xor dword ptr [esp], 60C4BC4Dh 0x0000002c pushad 0x0000002d mov si, dx 0x00000030 popad 0x00000031 mov eax, dword ptr fs:[00000000h] 0x00000037 jmp 00007FF634B8A947h 0x0000003c nop 0x0000003d pushad 0x0000003e mov eax, 111A443Bh 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 popad 0x00000047 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5460567 second address: 54605B4 instructions: 0x00000000 rdtsc 0x00000002 call 00007FF63516ECACh 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d mov dx, si 0x00000010 mov si, 9A59h 0x00000014 popad 0x00000015 nop 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FF63516ECB1h 0x0000001f sbb ax, CDA6h 0x00000024 jmp 00007FF63516ECB1h 0x00000029 popfd 0x0000002a mov di, cx 0x0000002d popad 0x0000002e rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 54605B4 second address: 5460603 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 7B4F0065h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub esp, 1Ch 0x0000000e pushad 0x0000000f mov dl, ah 0x00000011 mov cx, di 0x00000014 popad 0x00000015 push esp 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov dx, 8F42h 0x0000001d pushfd 0x0000001e jmp 00007FF634B8A943h 0x00000023 or ah, 0000003Eh 0x00000026 jmp 00007FF634B8A949h 0x0000002b popfd 0x0000002c popad 0x0000002d rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5460603 second address: 5460609 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5460609 second address: 5460671 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebx 0x0000000b pushad 0x0000000c mov esi, edx 0x0000000e jmp 00007FF634B8A941h 0x00000013 popad 0x00000014 xchg eax, esi 0x00000015 jmp 00007FF634B8A93Eh 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007FF634B8A93Ch 0x00000024 and ah, FFFFFFC8h 0x00000027 jmp 00007FF634B8A93Bh 0x0000002c popfd 0x0000002d jmp 00007FF634B8A948h 0x00000032 popad 0x00000033 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5460671 second address: 5460683 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF63516ECAEh 0x00000009 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5460683 second address: 546069D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF634B8A93Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 mov eax, edi 0x00000013 popad 0x00000014 rdtsc
                            Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 546069D second address: 54606C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, ecx 0x00000005 mov edi, esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, edi 0x0000000b jmp 00007FF63516ECAEh 0x00000010 push eax 0x00000011 jmp 00007FF63516ECABh 0x00000016 xchg eax, edi 0x00000017 pushad 0x00000018 push edi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
                            Tries to evade debugger and weak emulator (self modifying code)
                            Source: C:\Users\user\Desktop\file.exeSpecial instruction interceptor: First address: 63EBEF instructions caused by: Self-modifying code
                            Source: C:\Users\user\Desktop\file.exeSpecial instruction interceptor: First address: 7E67D0 instructions caused by: Self-modifying code
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSpecial instruction interceptor: First address: 6BEBEF instructions caused by: Self-modifying code
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeSpecial instruction interceptor: First address: 8667D0 instructions caused by: Self-modifying code
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSpecial instruction interceptor: First address: 87CB3D instructions caused by: Self-modifying code
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSpecial instruction interceptor: First address: 87CBBE instructions caused by: Self-modifying code
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSpecial instruction interceptor: First address: 87CAEB instructions caused by: Self-modifying code
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSpecial instruction interceptor: First address: A2790B instructions caused by: Self-modifying code
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSpecial instruction interceptor: First address: A4F5B6 instructions caused by: Self-modifying code
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSpecial instruction interceptor: First address: A31714 instructions caused by: Self-modifying code
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSpecial instruction interceptor: First address: AB2FB6 instructions caused by: Self-modifying code
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSpecial instruction interceptor: First address: A9CB2F instructions caused by: Self-modifying code
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSpecial instruction interceptor: First address: A9CC25 instructions caused by: Self-modifying code
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSpecial instruction interceptor: First address: C19221 instructions caused by: Self-modifying code
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSpecial instruction interceptor: First address: C3FB55 instructions caused by: Self-modifying code
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeSpecial instruction interceptor: First address: A9A696 instructions caused by: Self-modifying code
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSpecial instruction interceptor: First address: 72FC36 instructions caused by: Self-modifying code
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeSpecial instruction interceptor: First address: 72FD2E instructions caused by: Self-modifying code
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeSpecial instruction interceptor: First address: 3ADCA4 instructions caused by: Self-modifying code
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeSpecial instruction interceptor: First address: 3ADBF2 instructions caused by: Self-modifying code
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeSpecial instruction interceptor: First address: 54CE18 instructions caused by: Self-modifying code
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeSpecial instruction interceptor: First address: 81CB1C instructions caused by: Self-modifying code
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeSpecial instruction interceptor: First address: 81CA04 instructions caused by: Self-modifying code
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeSpecial instruction interceptor: First address: 81A44A instructions caused by: Self-modifying code
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeSpecial instruction interceptor: First address: 9D5846 instructions caused by: Self-modifying code
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeSpecial instruction interceptor: First address: A5AA42 instructions caused by: Self-modifying code
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeSpecial instruction interceptor: First address: 3B47F0 instructions caused by: Self-modifying code
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSpecial instruction interceptor: First address: 611DCA4 instructions caused by: Self-modifying code
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSpecial instruction interceptor: First address: 611DBF2 instructions caused by: Self-modifying code
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSpecial instruction interceptor: First address: 62BCE18 instructions caused by: Self-modifying code
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeSpecial instruction interceptor: First address: 61247F0 instructions caused by: Self-modifying code
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeMemory allocated: 2860000 memory reserve | memory write watchJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeMemory allocated: 28D0000 memory reserve | memory write watchJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeMemory allocated: 48D0000 memory reserve | memory write watchJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeMemory allocated: 5080000 memory reserve | memory write watch
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeMemory allocated: 5300000 memory reserve | memory write watch
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeMemory allocated: 5100000 memory reserve | memory write watch
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
                            Source: C:\Users\user\Desktop\file.exeCode function: 1_2_054B0250 rdtsc 1_2_054B0250
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeThread delayed: delay time: 922337203685477
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeWindow / User API: threadDelayed 1145Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeWindow / User API: threadDelayed 1121Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeWindow / User API: threadDelayed 1063Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeWindow / User API: threadDelayed 1127Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeWindow / User API: threadDelayed 1154Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeWindow / User API: threadDelayed 995Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeWindow / User API: threadDelayed 1109Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeWindow / User API: threadDelayed 1148Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeWindow / User API: threadDelayed 1034
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeWindow / User API: threadDelayed 1028
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeWindow / User API: threadDelayed 1044
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeWindow / User API: threadDelayed 977
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeWindow / User API: threadDelayed 1066
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeWindow / User API: threadDelayed 1023
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeWindow / User API: threadDelayed 1029
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeWindow / User API: threadDelayed 660
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeWindow / User API: threadDelayed 972
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeWindow / User API: threadDelayed 980
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeWindow / User API: threadDelayed 1516
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeWindow / User API: threadDelayed 979
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeWindow / User API: threadDelayed 1490
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeWindow / User API: threadDelayed 974
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\_sqlite3.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_MD5.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\charset_normalizer\md.cp313-win_amd64.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_Salsa20.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\freebl3[1].dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_BLAKE2b.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1033702001\31f59e2a09.exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_SHA384.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[3].exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\_overlapped.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1033704001\a85084d20f.exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\pyexpat.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\msvcp140[1].dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_aesni.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_chacha20.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_cbc.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_SHA512.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_RIPEMD160.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\vcruntime140[1].dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Protocol\_scrypt.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_ghash_portable.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_MD4.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeDropped PE file which has not been started: C:\ProgramData\softokn3.dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\unicodedata.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_ARC4.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\charset_normalizer\md__mypyc.cp313-win_amd64.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_BLAKE2s.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ONMZACOW\random[3].exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeDropped PE file which has not been started: C:\ProgramData\nss3.dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\PublicKey\_ec_ws.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_arc2.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_ofb.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_cast.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_ecb.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\select.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_SHA256.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[4].exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[4].exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeDropped PE file which has not been started: C:\ProgramData\freebl3.dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_ocb.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\mozglue[1].dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\_ctypes.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\_asyncio.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\_socket.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1033701001\01c00b6fe2.exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_aes.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_pkcs1_decode.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[4].exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\softokn3[1].dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\_ssl.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_ghash_clmul.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\_queue.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_des.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\nss3[1].dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\_wmi.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_poly1305.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\PublicKey\_ed25519.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1033703001\ba5ccf6bd8.exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Util\_cpuid_c.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\_hashlib.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[3].exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Util\_strxor.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_SHA1.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_SHA224.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[5].exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_cfb.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_des3.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\win32\win32crypt.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_blowfish.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1033700001\24a1c81f44.exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\PublicKey\_curve25519.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\_lzma.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\PublicKey\_ed448.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_ctr.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\_cffi_backend.cp313-win_amd64.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Math\_modexp.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[5].exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1033706001\4e6501ac3b.exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\PublicKey\_curve448.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\_multiprocessing.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1033707001\a0d135de95.exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_keccak.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1033705001\54d18f4f90.exeJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\python313.dllJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\_decimal.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\_bz2.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_eksblowfish.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_MD2.pydJump to dropped file
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2596Thread sleep count: 1145 > 30Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2596Thread sleep time: -2291145s >= -30000sJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2312Thread sleep count: 1121 > 30Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2312Thread sleep time: -2243121s >= -30000sJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2216Thread sleep count: 209 > 30Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2216Thread sleep time: -6270000s >= -30000sJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5652Thread sleep count: 1063 > 30Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5652Thread sleep time: -2127063s >= -30000sJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8076Thread sleep count: 1127 > 30Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8076Thread sleep time: -2255127s >= -30000sJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3908Thread sleep count: 1154 > 30Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3908Thread sleep time: -2309154s >= -30000sJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2800Thread sleep count: 995 > 30Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2800Thread sleep time: -1990995s >= -30000sJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4252Thread sleep count: 1109 > 30Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4252Thread sleep time: -2219109s >= -30000sJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2032Thread sleep count: 1148 > 30Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2032Thread sleep time: -2297148s >= -30000sJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exe TID: 7744Thread sleep time: -180000s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exe TID: 2660Thread sleep time: -2069034s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exe TID: 5932Thread sleep time: -2057028s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exe TID: 1476Thread sleep time: -30000s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exe TID: 1840Thread sleep time: -2089044s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exe TID: 6692Thread sleep time: -1954977s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exe TID: 8444Thread sleep time: -62031s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exe TID: 5400Thread sleep time: -2133066s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exe TID: 5820Thread sleep time: -2047023s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exe TID: 5668Thread sleep time: -2059029s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exe TID: 3036Thread sleep time: -46023s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exe TID: 4816Thread sleep time: -46023s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exe TID: 2496Thread sleep time: -56028s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exe TID: 1620Thread sleep time: -32000s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exe TID: 7860Thread sleep time: -60000s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exe TID: 6764Thread sleep time: -54027s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe TID: 4892Thread sleep time: -58029s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe TID: 6828Thread sleep time: -30015s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe TID: 1512Thread sleep time: -56028s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe TID: 8012Thread sleep time: -42021s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe TID: 6196Thread sleep time: -36000s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe TID: 5732Thread sleep time: -52026s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe TID: 5972Thread sleep time: -44022s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exe TID: 6964Thread sleep time: -90000s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exe TID: 3936Thread sleep time: -922337203685477s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe TID: 5952Thread sleep time: -50025s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe TID: 4072Thread sleep time: -42021s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe TID: 4292Thread sleep time: -36018s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe TID: 3088Thread sleep count: 156 > 30
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe TID: 3088Thread sleep time: -936000s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe TID: 7744Thread sleep time: -40020s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe TID: 7940Thread sleep time: -40020s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe TID: 7560Thread sleep count: 972 > 30
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe TID: 7560Thread sleep time: -1944972s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe TID: 6780Thread sleep count: 980 > 30
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe TID: 6780Thread sleep time: -1960980s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe TID: 5852Thread sleep count: 178 > 30
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe TID: 5852Thread sleep count: 152 > 30
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe TID: 5852Thread sleep count: 91 > 30
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe TID: 5852Thread sleep count: 158 > 30
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe TID: 7916Thread sleep count: 1516 > 30
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe TID: 7916Thread sleep time: -3033516s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe TID: 6868Thread sleep time: -32000s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe TID: 5816Thread sleep count: 979 > 30
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe TID: 5816Thread sleep time: -1958979s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe TID: 7944Thread sleep count: 1490 > 30
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe TID: 7944Thread sleep time: -2981490s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe TID: 7700Thread sleep count: 974 > 30
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe TID: 7700Thread sleep time: -1948974s >= -30000s
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
                            Source: C:\Windows\System32\dxdiag.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
                            Source: C:\Windows\System32\dxdiag.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
                            Source: C:\Windows\System32\dxdiag.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                            Source: C:\Windows\System32\dxdiag.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeLast function: Thread delayed
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeLast function: Thread delayed
                            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                            Source: C:\Users\user\Desktop\file.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeThread delayed: delay time: 30000Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeThread delayed: delay time: 922337203685477
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\
                            Source: skotes.exe, skotes.exe, 00000003.00000002.1487717715.0000000000847000.00000040.00000001.01000000.00000007.sdmpBinary or memory string: HARDWARE\ACPI\DSDT\VBOX__
                            Source: cf4bd6029c.exe, 00000016.00000003.2237466049.0000000005BCF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive userers - NDCDYNVMware20,11696501413z
                            Source: cf4bd6029c.exe, 00000016.00000003.2237466049.0000000005BCF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: tasks.office.comVMware20,11696501413o
                            Source: c061393b55.exe, 00000009.00000003.1990210927.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
                            Source: cf4bd6029c.exe, 00000016.00000003.2237466049.0000000005BCF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: trackpan.utiitsl.comVMware20,11696501413h
                            Source: cf4bd6029c.exe, 00000016.00000003.2237466049.0000000005BCF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: netportal.hdfcbank.comVMware20,11696501413
                            Source: cf4bd6029c.exe, 00000016.00000003.2237466049.0000000005BCF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: www.interactiveuserers.co.inVMware20,11696501413~
                            Source: cf4bd6029c.exe, 00000016.00000003.2237466049.0000000005BCF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: dev.azure.comVMware20,11696501413j
                            Source: cf4bd6029c.exe, 00000016.00000003.2237466049.0000000005BCF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive userers - COM.HKVMware20,11696501413
                            Source: db0740f8e4.exe, 0000000D.00000002.2182255416.000000000142B000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2123524420.000000000120D000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2123524420.0000000001206000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2122754416.0000000001205000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2385366413.000000000141B000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.0000000001418000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                            Source: cf4bd6029c.exe, 00000016.00000003.2237466049.0000000005BCF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Test URL for global passwords blocklistVMware20,11696501413
                            Source: cf4bd6029c.exe, 00000016.00000003.2237466049.0000000005BCF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: secure.bankofamerica.comVMware20,11696501413|UE
                            Source: cf4bd6029c.exe, 00000016.00000003.2237466049.0000000005BCF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: bankofamerica.comVMware20,11696501413x
                            Source: cf4bd6029c.exe, 00000016.00000003.2237466049.0000000005BCF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696501413}
                            Source: cf4bd6029c.exe, 00000016.00000003.2237466049.0000000005BCF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive userers - non-EU EuropeVMware20,11696501413
                            Source: cf4bd6029c.exe, 00000016.00000003.2237466049.0000000005BCF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696501413x
                            Source: cf4bd6029c.exe, 00000016.00000003.2237466049.0000000005BCF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: turbotax.intuit.comVMware20,11696501413t
                            Source: cf4bd6029c.exe, 00000016.00000003.2237466049.0000000005BCF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive userers - HKVMware20,11696501413]
                            Source: cf4bd6029c.exe, 00000016.00000003.2237466049.0000000005BCF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: outlook.office.comVMware20,11696501413s
                            Source: cf4bd6029c.exe, 00000016.00000003.2237466049.0000000005BCF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive userers - EU East & CentralVMware20,11696501413
                            Source: e0ac53ba53.exe, 00000015.00000003.2155752291.0000000005952000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: - GDCDYNVMware20,11696501413p
                            Source: cf4bd6029c.exe, 00000016.00000003.2237466049.0000000005BCF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: account.microsoft.com/profileVMware20,11696501413u
                            Source: cf4bd6029c.exe, 00000016.00000003.2237466049.0000000005BCF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive userers - GDCDYNVMware20,11696501413p
                            Source: cf4bd6029c.exe, 00000016.00000003.2237466049.0000000005BCF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive userers - EU WestVMware20,11696501413n
                            Source: cf4bd6029c.exe, 00000016.00000003.2237466049.0000000005BCF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: ms.portal.azure.comVMware20,11696501413
                            Source: cf4bd6029c.exe, 00000016.00000003.2237466049.0000000005BCF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696501413
                            Source: cf4bd6029c.exe, 00000016.00000003.2237466049.0000000005BCF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: www.interactiveuserers.comVMware20,11696501413}
                            Source: cf4bd6029c.exe, 00000016.00000003.2237466049.0000000005BCF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: interactiveuserers.co.inVMware20,11696501413d
                            Source: cf4bd6029c.exe, 00000016.00000003.2237466049.0000000005BCF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: microsoft.visualstudio.comVMware20,11696501413x
                            Source: cf4bd6029c.exe, 00000016.00000003.2237466049.0000000005BCF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: global block list test formVMware20,11696501413
                            Source: cf4bd6029c.exe, 00000016.00000003.2237466049.0000000005BCF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: outlook.office365.comVMware20,11696501413t
                            Source: cf4bd6029c.exe, 00000016.00000003.2237466049.0000000005BCF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696501413^
                            Source: file.exe, 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.1479897179.0000000000847000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000003.00000002.1487717715.0000000000847000.00000040.00000001.01000000.00000007.sdmpBinary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
                            Source: db0740f8e4.exe, 0000000D.00000002.2182255416.0000000001400000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWX1D
                            Source: cf4bd6029c.exe, 00000016.00000003.2237466049.0000000005BCF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: interactiveuserers.comVMware20,11696501413
                            Source: cf4bd6029c.exe, 00000016.00000003.2237466049.0000000005BCF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: discord.comVMware20,11696501413f
                            Source: cf4bd6029c.exe, 00000016.00000003.2237466049.0000000005BCF000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: AMC password management pageVMware20,11696501413
                            Source: C:\Users\user\Desktop\file.exeSystem information queried: ModuleInformationJump to behavior
                            Source: C:\Users\user\Desktop\file.exeProcess information queried: ProcessInformationJump to behavior

                            Anti Debugging

                            barindex
                            Hides threads from debuggers
                            Source: C:\Users\user\Desktop\file.exeThread information set: HideFromDebuggerJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeThread information set: HideFromDebuggerJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeThread information set: HideFromDebuggerJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeThread information set: HideFromDebuggerJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeThread information set: HideFromDebugger
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeThread information set: HideFromDebugger
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeThread information set: HideFromDebugger
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeThread information set: HideFromDebugger
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeThread information set: HideFromDebugger
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeThread information set: HideFromDebugger
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeThread information set: HideFromDebugger
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeThread information set: HideFromDebugger
                            Tries to detect sandboxes and other dynamic analysis tools (window names)
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeOpen window title or class name: regmonclass
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeOpen window title or class name: gbdyllo
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeOpen window title or class name: process monitor - sysinternals: www.sysinternals.com
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeOpen window title or class name: procmon_window_class
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeOpen window title or class name: registry monitor - sysinternals: www.sysinternals.com
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeOpen window title or class name: ollydbg
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeOpen window title or class name: filemonclass
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeOpen window title or class name: file monitor - sysinternals: www.sysinternals.com
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeFile opened: NTICE
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeFile opened: SICE
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeFile opened: SIWVID
                            Source: C:\Users\user\Desktop\file.exeProcess queried: DebugPortJump to behavior
                            Source: C:\Users\user\Desktop\file.exeProcess queried: DebugPortJump to behavior
                            Source: C:\Users\user\Desktop\file.exeProcess queried: DebugPortJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess queried: DebugPortJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess queried: DebugPortJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess queried: DebugPortJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess queried: DebugPortJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess queried: DebugPortJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess queried: DebugPortJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess queried: DebugPortJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess queried: DebugPortJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess queried: DebugPortJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeProcess queried: DebugPortJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeProcess queried: DebugPortJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeProcess queried: DebugPort
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeProcess queried: DebugPort
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeProcess queried: DebugPort
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeProcess queried: DebugPort
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeProcess queried: DebugPort
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeProcess queried: DebugPort
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeProcess queried: DebugPort
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeProcess queried: DebugPort
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeProcess queried: DebugPort
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeProcess queried: DebugPort
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeProcess queried: DebugPort
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeProcess queried: DebugPort
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeProcess queried: DebugPort
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeProcess queried: DebugPort
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeProcess queried: DebugPort
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeProcess queried: DebugPort
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeProcess queried: DebugPort
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeProcess queried: DebugPort
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeProcess queried: DebugPort
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeProcess queried: DebugPort
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeProcess queried: DebugPort
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeProcess queried: DebugPort
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeProcess queried: DebugPort
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeProcess queried: DebugPort
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeProcess queried: DebugPort
                            Source: C:\Users\user\Desktop\file.exeCode function: 1_2_054B0250 rdtsc 1_2_054B0250
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 13_2_00442080 LdrInitializeThunk,13_2_00442080
                            Source: C:\Users\user\Desktop\file.exeCode function: 1_2_0060652B mov eax, dword ptr fs:[00000030h]1_2_0060652B
                            Source: C:\Users\user\Desktop\file.exeCode function: 1_2_0060A302 mov eax, dword ptr fs:[00000030h]1_2_0060A302
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeCode function: 2_2_0068A302 mov eax, dword ptr fs:[00000030h]2_2_0068A302
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeCode function: 2_2_0068652B mov eax, dword ptr fs:[00000030h]2_2_0068652B
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeCode function: 3_2_0068A302 mov eax, dword ptr fs:[00000030h]3_2_0068A302
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeCode function: 3_2_0068652B mov eax, dword ptr fs:[00000030h]3_2_0068652B
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 11_2_028D7FE5 mov edi, dword ptr fs:[00000030h]11_2_028D7FE5
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 11_2_028D8162 mov edi, dword ptr fs:[00000030h]11_2_028D8162
                            Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: Debug
                            Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: Debug
                            Source: C:\Windows\System32\taskkill.exeProcess token adjusted: Debug
                            Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: Debug
                            Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: Debug
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeProcess token adjusted: Debug
                            Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: Debug
                            Source: C:\Windows\System32\taskkill.exeProcess token adjusted: Debug
                            Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: Debug
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeMemory allocated: page read and write | page guardJump to behavior

                            HIPS / PFW / Operating System Protection Evasion

                            barindex
                            Contains functionality to inject code into remote processes
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeCode function: 11_2_028D7FE5 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,11_2_028D7FE5
                            Creates a thread in another existing process (thread injection)
                            Source: C:\Users\user\AppData\Local\Temp\1033699001\8c9c7a39f7.exeThread created: unknown EIP: 5C8A60
                            Injects a PE file into a foreign processes
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeMemory written: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exe base: 400000 value starts with: 4D5AJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033699001\8c9c7a39f7.exeMemory written: C:\Users\user\AppData\Local\Temp\1033699001\8c9c7a39f7.exe base: 5C0000 value starts with: 4D5A
                            LummaC encrypted strings found
                            Source: db0740f8e4.exe, 0000000B.00000002.2224918424.00000000038D9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: cloudewahsj.shop
                            Source: db0740f8e4.exe, 0000000B.00000002.2224918424.00000000038D9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: rabidcowse.shop
                            Source: db0740f8e4.exe, 0000000B.00000002.2224918424.00000000038D9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: noisycuttej.shop
                            Source: db0740f8e4.exe, 0000000B.00000002.2224918424.00000000038D9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: tirepublicerj.shop
                            Source: db0740f8e4.exe, 0000000B.00000002.2224918424.00000000038D9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: framekgirus.shop
                            Source: db0740f8e4.exe, 0000000B.00000002.2224918424.00000000038D9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: wholersorie.shop
                            Source: db0740f8e4.exe, 0000000B.00000002.2224918424.00000000038D9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: abruptyopsn.shop
                            Source: db0740f8e4.exe, 0000000B.00000002.2224918424.00000000038D9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: nearycrepso.shop
                            Source: db0740f8e4.exe, 0000000B.00000002.2224918424.00000000038D9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: pancakedipyps.click
                            Source: e0ac53ba53.exe, 00000015.00000003.2093443275.0000000004DA0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: fancywaxxers.shop
                            Source: C:\Users\user\Desktop\file.exeProcess created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe "C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe" Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exe "C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exe" Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exe "C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exe" Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exe "C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exe" Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe "C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe" Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exe "C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exe" Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exe "C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exe" Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe "C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe" Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: C:\Users\user\AppData\Local\Temp\1033699001\8c9c7a39f7.exe "C:\Users\user\AppData\Local\Temp\1033699001\8c9c7a39f7.exe" Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: unknown unknownJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: unknown unknownJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: unknown unknownJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: unknown unknownJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: unknown unknownJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: unknown unknownJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: unknown unknownJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: unknown unknownJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeProcess created: unknown unknownJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeProcess created: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe "C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe" Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "dxdiag /t C:\Users\user\AppData\Local\Bunny\Info.txt"Jump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeProcess created: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exe "C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exe"Jump to behavior
                            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\dxdiag.exe dxdiag /t C:\Users\user\AppData\Local\Bunny\Info.txt
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeProcess created: unknown unknown
                            Source: C:\Users\user\AppData\Local\Temp\1033699001\8c9c7a39f7.exeProcess created: unknown unknown
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeProcess created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exeJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
                            Source: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
                            Source: skotes.exe, skotes.exe, 00000003.00000002.1488107501.000000000088A000.00000040.00000001.01000000.00000007.sdmpBinary or memory string: Program Manager
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033699001\8c9c7a39f7.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033699001\8c9c7a39f7.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033700001\24a1c81f44.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033700001\24a1c81f44.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033701001\01c00b6fe2.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033701001\01c00b6fe2.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033702001\31f59e2a09.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033702001\31f59e2a09.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033703001\ba5ccf6bd8.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033703001\ba5ccf6bd8.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033704001\a85084d20f.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033704001\a85084d20f.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033705001\54d18f4f90.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033705001\54d18f4f90.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033706001\4e6501ac3b.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033706001\4e6501ac3b.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033707001\a0d135de95.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033707001\a0d135de95.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033708001\627cf45047.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033708001\627cf45047.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\PublicKey VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Util VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\certifi VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\_ctypes.pyd VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\_bz2.pyd VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\_lzma.pyd VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\win32 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\pyexpat.pyd VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\win32 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\pywin32_system32 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor\jaraco VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\win32 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\pywin32_system32 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\_queue.pyd VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\_hashlib.pyd VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\_socket.pyd VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\select.pyd VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\_ssl.pyd VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\win32 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\pywin32_system32 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\win32 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor\jaraco\text\Lorem ipsum.txt VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor\jaraco\text\Lorem ipsum.txt VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\win32 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\win32 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\pywin32_system32 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\win32 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\pywin32_system32 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\win32 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\pywin32_system32 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\_sqlite3.pyd VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\win32 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\pywin32_system32 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\win32 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\pywin32_system32 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\win32 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\win32 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\win32 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\charset_normalizer VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\charset_normalizer VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\charset_normalizer VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\charset_normalizer VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\charset_normalizer\md__mypyc.cp313-win_amd64.pyd VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\win32 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\pywin32_system32 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162 VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\certifi VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeQueries volume information: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exe VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeQueries volume information: C:\ VolumeInformation
                            Source: C:\Windows\System32\dxdiag.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0516~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                            Source: C:\Windows\System32\dxdiag.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0110~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                            Source: C:\Windows\System32\dxdiag.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0110~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeQueries volume information: C:\ VolumeInformation
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeQueries volume information: C:\ VolumeInformation
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeQueries volume information: C:\ VolumeInformation
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeQueries volume information: C:\ VolumeInformation
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeQueries volume information: C:\ VolumeInformation
                            Source: C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exeQueries volume information: C:\ VolumeInformation
                            Source: C:\Users\user\Desktop\file.exeCode function: 1_2_005ECBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,1_2_005ECBEA
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

                            Lowering of HIPS / PFW / Operating System Security Settings

                            barindex
                            Disable Windows Defender notifications (registry)
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1
                            Disable Windows Defender real time protection (registry)
                            Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableIOAVProtection 1
                            Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableRealtimeMonitoring 1
                            Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\NotificationsRegistry value created: DisableNotifications 1
                            Disables Windows Defender Tamper protection
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeRegistry value created: TamperProtection 0
                            Modifies windows update settings
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
                            Source: C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations
                            Source: cf4bd6029c.exe, 00000016.00000003.2473339717.0000000001466000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Windows Defender\MsMpeng.exe
                            Source: e0ac53ba53.exe, e0ac53ba53.exe, 00000015.00000003.2240142291.0000000001258000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2240312371.0000000005931000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2253717755.0000000001255000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2252886391.0000000005931000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2386196260.0000000001480000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2370059128.0000000001480000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

                            Stealing of Sensitive Information

                            barindex
                            Yara detected Amadey
                            Source: Yara matchFile source: decrypted.memstr, type: MEMORYSTR
                            Yara detected Amadeys Clipper DLL
                            Source: Yara matchFile source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[4].exe, type: DROPPED
                            Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\1033705001\54d18f4f90.exe, type: DROPPED
                            Yara detected Amadeys stealer DLL
                            Source: Yara matchFile source: 2.2.skotes.exe.650000.0.unpack, type: UNPACKEDPE
                            Source: Yara matchFile source: 3.2.skotes.exe.650000.0.unpack, type: UNPACKEDPE
                            Source: Yara matchFile source: 1.2.file.exe.5d0000.0.unpack, type: UNPACKEDPE
                            Source: Yara matchFile source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
                            Source: Yara matchFile source: 00000003.00000002.1486452961.0000000000651000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
                            Source: Yara matchFile source: 00000002.00000002.1479494441.0000000000651000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
                            Yara detected LummaC Stealer
                            Source: Yara matchFile source: decrypted.memstr, type: MEMORYSTR
                            Source: Yara matchFile source: Process Memory Space: cf4bd6029c.exe PID: 5516, type: MEMORYSTR
                            Source: Yara matchFile source: Process Memory Space: e0ac53ba53.exe PID: 6660, type: MEMORYSTR
                            Yara detected PureLog Stealer
                            Source: Yara matchFile source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[5].exe, type: DROPPED
                            Source: Yara matchFile source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[3].exe, type: DROPPED
                            Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\1033700001\24a1c81f44.exe, type: DROPPED
                            Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\1033706001\4e6501ac3b.exe, type: DROPPED
                            Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\1033704001\a85084d20f.exe, type: DROPPED
                            Yara detected Stealc
                            Source: Yara matchFile source: 00000032.00000003.2429756005.0000000004D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                            Source: Yara matchFile source: 00000019.00000003.2243727892.0000000004A90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                            Found many strings related to Crypto-Wallets (likely being stolen)
                            Source: db0740f8e4.exe, 0000000D.00000002.2182255416.000000000142B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Wallets/Electrum-LTC
                            Source: db0740f8e4.exe, 0000000D.00000002.2182255416.000000000142B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Wallets/ElectronCash
                            Source: db0740f8e4.exe, 0000000D.00000002.2182255416.000000000142B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: window-state.json
                            Source: e0ac53ba53.exeString found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
                            Source: e0ac53ba53.exeString found in binary or memory: \Exodus\\exodus.wallet","m":["*"],"z":"Wallets/Exodus","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Ledger Live","m":["*"],"z":"Wallets/Ledger Live","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\atomic\\Local Storage\\leveldb","m":["*"],"z":"Wallets/Atomic","d":2
                            Source: e0ac53ba53.exeString found in binary or memory: \Exodus\\exodus.wallet","m":["*"],"z":"Wallets/Exodus","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Ledger Live","m":["*"],"z":"Wallets/Ledger Live","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\atomic\\Local Storage\\leveldb","m":["*"],"z":"Wallets/Atomic","d":2
                            Source: db0740f8e4.exe, 0000000D.00000002.2182255416.000000000142B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Wallets/Ethereum
                            Source: e0ac53ba53.exeString found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
                            Source: e0ac53ba53.exeString found in binary or memory: gbnbgdfflelocpak","ez":"Bitget Wallet"}],"mx":[{"en":"webextension@metamask.io","ez":"MetaMask","et":"\"params\":{\"iterations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%
                            Tries to harvest and steal Bitcoin Wallet information
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core
                            Tries to harvest and steal browser information (history, passwords, etc)
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mdjmfdffdcmnoblignmgpommbefadffdJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhilaheimglignddkjgofkcbgekhenbhJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\places.sqlite
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ebfidpplhabeedpnhjnobghokpiiooljJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\webdata.dbJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\epapihdplajcdnnkdeiahlgigofloibgJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nphplpgoakhhjchkkhmiggakijnkhfndJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cgeeodpfagjceefieflmdfphplkenlfkJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\places.sqlite-shm
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\logins.json
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\cookies.sqlite-wal
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pdadjkfkgcafgbceimcpbkalnfnepbnkJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\cert9.db
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\DefaultJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\cookies.sqlite-shm
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mgffkfbidihjpoaomajlbgchddlicgpnJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\prefs.js
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflcJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\cookies.sqlite
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hmeobnfnfcmdkdcmlblgagmfpfboieafJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\formhistory.sqlite
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\places.sqlite-wal
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\key4.db
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.iniJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\khpkpbbcccdmmclmpigdgddabeilkdpdJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
                            Source: C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\passwords.dbJump to behavior
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
                            Tries to harvest and steal ftp login credentials
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Roaming\FTPInfo
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Roaming\FTPRush
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Roaming\FTPbox
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\ProgramData\SiteDesigner\3D-FTP
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Roaming\FTPGetter
                            Tries to steal Crypto Currency Wallets
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeFile opened: C:\Users\user\AppData\Roaming\Ledger Live
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeFile opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeFile opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeFile opened: C:\Users\user\AppData\Roaming\Binance
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeFile opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\wallets
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeFile opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeFile opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeFile opened: C:\Users\user\AppData\Roaming\Ledger Live
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeFile opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeFile opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeFile opened: C:\Users\user\AppData\Roaming\Binance
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeFile opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\wallets
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeFile opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeFile opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Roaming\Ledger Live
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Roaming\Binance
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\wallets
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeFile opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\BJZFPPWAPT
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\BJZFPPWAPT
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\EFOYFBOLXA
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\EFOYFBOLXA
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\EOWRVPQCCS
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\EOWRVPQCCS
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\GRXZDKKVDB
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\GRXZDKKVDB
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\HMPPSXQPQV
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\HMPPSXQPQV
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\JDDHMPCDUJ
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\JDDHMPCDUJ
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\LHEPQPGEWF
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\LHEPQPGEWF
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\NVWZAPQSQL
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\NVWZAPQSQL
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\NYMMPCEIMA
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\NYMMPCEIMA
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\QFAPOWPAFG
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\QFAPOWPAFG
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\EFOYFBOLXA
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\EFOYFBOLXA
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\EOWRVPQCCS
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\EOWRVPQCCS
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\GRXZDKKVDB
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\GRXZDKKVDB
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\JDDHMPCDUJ
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\JDDHMPCDUJ
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\NYMMPCEIMA
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\NYMMPCEIMA
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\ZGGKNSUKOP
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\ZGGKNSUKOP
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\BJZFPPWAPT
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\BJZFPPWAPT
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\EFOYFBOLXA
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\EFOYFBOLXA
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\GRXZDKKVDB
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\GRXZDKKVDB
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\UNKRLCVOHV
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\UNKRLCVOHV
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\BJZFPPWAPT
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\BJZFPPWAPT
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\EFOYFBOLXA
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\EFOYFBOLXA
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\GRXZDKKVDB
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\GRXZDKKVDB
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\HMPPSXQPQV
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\HMPPSXQPQV
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\JDDHMPCDUJ
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\JDDHMPCDUJ
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\EFOYFBOLXA
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\EFOYFBOLXA
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\EOWRVPQCCS
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\EOWRVPQCCS
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\BJZFPPWAPT
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: C:\Users\user\Documents\BJZFPPWAPT
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\BJZFPPWAPT
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\BJZFPPWAPT
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\EFOYFBOLXA
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\EFOYFBOLXA
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\GRXZDKKVDB
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\GRXZDKKVDB
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\HMPPSXQPQV
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\HMPPSXQPQV
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\NYMMPCEIMA
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\NYMMPCEIMA
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\BJZFPPWAPT
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\BJZFPPWAPT
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\BJZFPPWAPT
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\BJZFPPWAPT
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\EFOYFBOLXA
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\EFOYFBOLXA
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\BJZFPPWAPT
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\BJZFPPWAPT
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\EOWRVPQCCS
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\EOWRVPQCCS
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\HMPPSXQPQV
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\HMPPSXQPQV
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\JDDHMPCDUJ
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\JDDHMPCDUJ
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\LHEPQPGEWF
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\LHEPQPGEWF
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\NVWZAPQSQL
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\NVWZAPQSQL
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\QFAPOWPAFG
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\QFAPOWPAFG
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\UNKRLCVOHV
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\UNKRLCVOHV
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\NYMMPCEIMA
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: C:\Users\user\Documents\NYMMPCEIMA
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\BJZFPPWAPT
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\BJZFPPWAPT
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\EFOYFBOLXA
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\EFOYFBOLXA
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\EOWRVPQCCS
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\EOWRVPQCCS
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\GRXZDKKVDB
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\GRXZDKKVDB
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\HMPPSXQPQV
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\HMPPSXQPQV
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\JDDHMPCDUJ
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\JDDHMPCDUJ
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\LHEPQPGEWF
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\LHEPQPGEWF
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\NVWZAPQSQL
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\NVWZAPQSQL
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\NYMMPCEIMA
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\NYMMPCEIMA
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\QFAPOWPAFG
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\QFAPOWPAFG
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\UNKRLCVOHV
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\UNKRLCVOHV
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\ZGGKNSUKOP
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\ZGGKNSUKOP
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\BJZFPPWAPT
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\BJZFPPWAPT
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\EFOYFBOLXA
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\EFOYFBOLXA
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\EOWRVPQCCS
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\EOWRVPQCCS
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\GRXZDKKVDB
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\GRXZDKKVDB
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\JDDHMPCDUJ
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\JDDHMPCDUJ
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\LHEPQPGEWF
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\LHEPQPGEWF
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\NYMMPCEIMA
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\NYMMPCEIMA
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\ZGGKNSUKOP
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\ZGGKNSUKOP
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\EFOYFBOLXA
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\EFOYFBOLXA
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\GRXZDKKVDB
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\GRXZDKKVDB
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\HMPPSXQPQV
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\HMPPSXQPQV
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\JDDHMPCDUJ
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\JDDHMPCDUJ
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\LHEPQPGEWF
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\LHEPQPGEWF
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\NVWZAPQSQL
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\NVWZAPQSQL
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\NYMMPCEIMA
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\NYMMPCEIMA
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\QFAPOWPAFG
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\QFAPOWPAFG
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\UNKRLCVOHV
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\UNKRLCVOHV
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\ZGGKNSUKOP
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\ZGGKNSUKOP
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\EFOYFBOLXA
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\EFOYFBOLXA
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\BJZFPPWAPT
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\BJZFPPWAPT
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\EFOYFBOLXA
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\EFOYFBOLXA
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\GRXZDKKVDB
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\GRXZDKKVDB
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\JDDHMPCDUJ
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\JDDHMPCDUJ
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\LHEPQPGEWF
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\LHEPQPGEWF
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\NVWZAPQSQL
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\NVWZAPQSQL
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\NYMMPCEIMA
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\NYMMPCEIMA
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\BJZFPPWAPT
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\BJZFPPWAPT
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\EOWRVPQCCS
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\EOWRVPQCCS
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\HMPPSXQPQV
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\HMPPSXQPQV
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\NVWZAPQSQL
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\NVWZAPQSQL
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\ZGGKNSUKOP
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\ZGGKNSUKOP
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\HMPPSXQPQV
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\HMPPSXQPQV
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\QFAPOWPAFG
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\QFAPOWPAFG
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\ZGGKNSUKOP
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: C:\Users\user\Documents\ZGGKNSUKOP
                            Source: C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exeDirectory queried: number of queries: 1001
                            Source: C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exeDirectory queried: number of queries: 1001
                            Source: C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exeDirectory queried: number of queries: 1001
                            Source: Yara matchFile source: 00000016.00000003.2299818266.0000000001418000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                            Source: Yara matchFile source: 00000016.00000003.2299582589.0000000001464000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                            Source: Yara matchFile source: 00000015.00000003.2211666253.0000000001253000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                            Source: Yara matchFile source: 00000016.00000003.2312742082.000000000141B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                            Source: Yara matchFile source: Process Memory Space: e0ac53ba53.exe PID: 6660, type: MEMORYSTR
                            Source: Yara matchFile source: Process Memory Space: cf4bd6029c.exe PID: 5516, type: MEMORYSTR

                            Remote Access Functionality

                            barindex
                            Attempt to bypass Chrome Application-Bound Encryption
                            Source: C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
                            Yara detected LummaC Stealer
                            Source: Yara matchFile source: decrypted.memstr, type: MEMORYSTR
                            Source: Yara matchFile source: Process Memory Space: cf4bd6029c.exe PID: 5516, type: MEMORYSTR
                            Source: Yara matchFile source: Process Memory Space: e0ac53ba53.exe PID: 6660, type: MEMORYSTR
                            Yara detected PureLog Stealer
                            Source: Yara matchFile source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[5].exe, type: DROPPED
                            Source: Yara matchFile source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[3].exe, type: DROPPED
                            Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\1033700001\24a1c81f44.exe, type: DROPPED
                            Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\1033706001\4e6501ac3b.exe, type: DROPPED
                            Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\1033704001\a85084d20f.exe, type: DROPPED
                            Yara detected Stealc
                            Source: Yara matchFile source: 00000032.00000003.2429756005.0000000004D80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                            Source: Yara matchFile source: 00000019.00000003.2243727892.0000000004A90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

                            Mitre Att&ck Matrix

                            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                            Gather Victim Identity InformationAcquire InfrastructureValid Accounts341
                            Windows Management Instrumentation                            		1
                            LSASS Driver                            		1
                            LSASS Driver                            		411
                            Disable or Modify Tools                            		2
                            OS Credential Dumping                            		1
                            System Time Discovery                            		Remote Services11
                            Archive Collected Data                            		1
                            Ingress Tool Transfer                            		Exfiltration Over Other Network MediumAbuse Accessibility Features
                            CredentialsDomainsDefault Accounts1
                            Native API                            		1
                            DLL Side-Loading                            		1
                            DLL Side-Loading                            		111
                            Deobfuscate/Decode Files or Information                            		1
                            Input Capture                            		22
                            File and Directory Discovery                            		Remote Desktop Protocol41
                            Data from Local System                            		2
                            Encrypted Channel                            		Exfiltration Over BluetoothNetwork Denial of Service
                            Email AddressesDNS ServerDomain Accounts2
                            Command and Scripting Interpreter                            		1
                            Scheduled Task/Job                            		2
                            Bypass User Account Control                            		5
                            Obfuscated Files or Information                            		Security Account Manager346
                            System Information Discovery                            		SMB/Windows Admin Shares1
                            Screen Capture                            		1
                            Remote Access Software                            		Automated ExfiltrationData Encrypted for Impact
                            Employee NamesVirtual Private ServerLocal Accounts1
                            Scheduled Task/Job                            		11
                            Registry Run Keys / Startup Folder                            		1
                            Extra Window Memory Injection                            		22
                            Software Packing                            		NTDS1
                            Query Registry                            		Distributed Component Object Model1
                            Input Capture                            		1
                            Application Layer Protocol                            		Traffic DuplicationData Destruction
                            Gather Victim Network InformationServerCloud Accounts1
                            PowerShell                            		Network Logon Script312
                            Process Injection                            		1
                            Timestomp                            		LSA Secrets1181
                            Security Software Discovery                            		SSH2
                            Clipboard Data                            		Fallback ChannelsScheduled TransferData Encrypted for Impact
                            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts1
                            Scheduled Task/Job                            		1
                            DLL Side-Loading                            		Cached Domain Credentials2
                            Process Discovery                            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items11
                            Registry Run Keys / Startup Folder                            		2
                            Bypass User Account Control                            		DCSync581
                            Virtualization/Sandbox Evasion                            		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
                            Extra Window Memory Injection                            		Proc Filesystem1
                            Application Window Discovery                            		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                            Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt11
                            Masquerading                            		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                            IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron581
                            Virtualization/Sandbox Evasion                            		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement
                            Network Security AppliancesDomainsCompromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd312
                            Process Injection                            		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingMail ProtocolsExfiltration Over Unencrypted Non-C2 ProtocolFirmware Corruption

                            Behavior Graph

                            Hide Legend

                            Legend:

                            • Process
                            • Signature
                            • Created File
                            • DNS/IP Info
                            • Is Dropped
                            • Is Windows Process
                            • Number of created Registry Values
                            • Number of created Files
                            • Visual Basic
                            • Delphi
                            • Java
                            • .Net C# or VB.NET
                            • C, C++ or other language
                            • Is malicious
                            • Internet
                            behaviorgraph top1 signatures2 2 Behavior Graph ID: 1585286 Sample: file.exe Startdate: 07/01/2025 Architecture: WINDOWS Score: 100 148 Found malware configuration 2->148 150 Antivirus detection for URL or domain 2->150 152 Antivirus detection for dropped file 2->152 154 19 other signatures 2->154 9 skotes.exe 4 81 2->9         started        14 file.exe 5 2->14         started        16 skotes.exe 2->16         started        18 5 other processes 2->18 process3 dnsIp4 136 185.215.113.43 WHOLESALECONNECTIONSNL Portugal 9->136 138 185.215.113.16 WHOLESALECONNECTIONSNL Portugal 9->138 140 31.41.244.11 AEROEXPRESS-ASRU Russian Federation 9->140 106 C:\Users\user\AppData\...\a0d135de95.exe, PE32 9->106 dropped 108 C:\Users\user\AppData\...\4e6501ac3b.exe, PE32 9->108 dropped 110 C:\Users\user\AppData\...\54d18f4f90.exe, PE32 9->110 dropped 116 31 other malicious files 9->116 dropped 198 Creates multiple autostart registry keys 9->198 200 Hides threads from debuggers 9->200 202 Tries to detect sandboxes / dynamic malware analysis system (registry check) 9->202 20 c061393b55.exe 106 9->20         started        24 05c06146f2.exe 9->24         started        27 cf4bd6029c.exe 9->27         started        33 6 other processes 9->33 112 C:\Users\user\AppData\Local\...\skotes.exe, PE32 14->112 dropped 114 C:\Users\user\...\skotes.exe:Zone.Identifier, ASCII 14->114 dropped 204 Detected unpacking (changes PE section rights) 14->204 206 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 14->206 208 Tries to evade debugger and weak emulator (self modifying code) 14->208 210 Tries to detect virtualization through RDTSC time measurements 14->210 29 skotes.exe 14->29         started        212 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 16->212 31 firefox.exe 18->31         started        file5 signatures6 process7 dnsIp8 86 C:\Users\user\AppData\...\win32crypt.pyd, PE32+ 20->86 dropped 88 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 20->88 dropped 90 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32+ 20->90 dropped 100 67 other malicious files 20->100 dropped 156 Multi AV Scanner detection for dropped file 20->156 158 Found pyInstaller with non standard icon 20->158 35 c061393b55.exe 12 20->35         started        128 185.215.113.206 WHOLESALECONNECTIONSNL Portugal 24->128 92 C:\Users\user\AppData\...\softokn3[1].dll, PE32 24->92 dropped 94 C:\Users\user\AppData\Local\...\nss3[1].dll, PE32 24->94 dropped 102 10 other files (6 malicious) 24->102 dropped 160 Attempt to bypass Chrome Application-Bound Encryption 24->160 176 5 other signatures 24->176 40 msedge.exe 24->40         started        42 chrome.exe 24->42         started        96 C:\Users\user\...\ITH3569MCVRCZNYE5XQ77V.exe, PE32 27->96 dropped 98 C:\Users\user\...\F92YSIFAGW8CC4SRE.exe, PE32 27->98 dropped 162 Detected unpacking (changes PE section rights) 27->162 164 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 27->164 166 Query firmware table information (likely to detect VMs) 27->166 168 Tries to steal Crypto Currency Wallets 27->168 170 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 29->170 178 2 other signatures 29->178 44 firefox.exe 31->44         started        130 185.156.73.23 RELDAS-NETRU Russian Federation 33->130 132 104.21.112.1 CLOUDFLARENETUS United States 33->132 134 104.102.49.254 AKAMAI-ASUS United States 33->134 172 Tries to detect sandboxes and other dynamic analysis tools (window names) 33->172 174 Contains functionality to inject code into remote processes 33->174 180 7 other signatures 33->180 46 db0740f8e4.exe 33->46         started        48 WerFault.exe 33->48         started        50 taskkill.exe 33->50         started        52 7 other processes 33->52 file9 signatures10 process11 dnsIp12 118 149.154.167.220 TELEGRAMRU United Kingdom 35->118 120 104.26.9.59 CLOUDFLARENETUS United States 35->120 122 127.0.0.1 unknown unknown 35->122 104 C:\Users\user\AppData\Local\...\passwords.db, SQLite 35->104 dropped 182 Tries to harvest and steal browser information (history, passwords, etc) 35->182 54 cmd.exe 35->54         started        56 chrome.exe 35->56         started        58 taskkill.exe 35->58         started        68 3 other processes 35->68 184 Monitors registry run keys for changes 40->184 124 188.114.96.3 CLOUDFLARENETUS European Union 46->124 186 Query firmware table information (likely to detect VMs) 46->186 188 Found many strings related to Crypto-Wallets (likely being stolen) 46->188 190 Tries to steal Crypto Currency Wallets 46->190 126 20.42.65.92 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 48->126 60 conhost.exe 50->60         started        62 conhost.exe 52->62         started        64 conhost.exe 52->64         started        66 conhost.exe 52->66         started        70 2 other processes 52->70 file13 signatures14 process15 process16 72 dxdiag.exe 54->72         started        75 conhost.exe 54->75         started        77 chrome.exe 56->77         started        80 conhost.exe 58->80         started        82 conhost.exe 68->82         started        84 chrome.exe 68->84         started        dnsIp17 192 Query firmware table information (likely to detect VMs) 72->192 194 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 72->194 196 Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes) 72->196 142 142.250.185.163 GOOGLEUS United States 77->142 144 142.250.185.206 GOOGLEUS United States 77->144 146 2 other IPs or domains 77->146 signatures18

                            Screenshots

                            Thumbnails

                            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                            windows-stand

                            Antivirus, Machine Learning and Genetic Malware Detection

                            Initial Sample

                            SourceDetectionScannerLabelLink
                            file.exe58%VirustotalBrowse
                            file.exe58%ReversingLabsWin32.Infostealer.Tinba
                            file.exe100%AviraTR/Crypt.TPM.Gen
                            file.exe100%Joe Sandbox ML

                            Dropped Files

                            SourceDetectionScannerLabelLink
                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[2].exe100%AviraTR/ATRAPS.Gen
                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[1].exe100%AviraTR/ATRAPS.Gen
                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[2].exe100%AviraHEUR/AGEN.1320706
                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[1].exe100%AviraTR/Crypt.TPM.Gen
                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[3].exe100%AviraTR/Crypt.TPM.Gen
                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[2].exe100%Joe Sandbox ML
                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[1].exe100%Joe Sandbox ML
                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[2].exe100%Joe Sandbox ML
                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[1].exe100%Joe Sandbox ML
                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[3].exe100%Joe Sandbox ML
                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[3].exe100%Joe Sandbox ML
                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[4].exe100%Joe Sandbox ML
                            C:\ProgramData\freebl3.dll0%ReversingLabs
                            C:\ProgramData\mozglue.dll0%ReversingLabs
                            C:\ProgramData\msvcp140.dll0%ReversingLabs
                            C:\ProgramData\nss3.dll0%ReversingLabs
                            C:\ProgramData\softokn3.dll0%ReversingLabs
                            C:\ProgramData\vcruntime140.dll0%ReversingLabs
                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\freebl3[1].dll0%ReversingLabs
                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\mozglue[1].dll0%ReversingLabs
                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\msvcp140[1].dll0%ReversingLabs
                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\nss3[1].dll0%ReversingLabs
                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[4].exe55%ReversingLabsWin32.Infostealer.Tinba
                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\softokn3[1].dll0%ReversingLabs
                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\vcruntime140[1].dll0%ReversingLabs
                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[1].exe50%ReversingLabsWin32.Trojan.Generic
                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[3].exe45%ReversingLabsByteCode-MSIL.Trojan.LummaC
                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[4].exe11%ReversingLabs
                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[5].exe22%ReversingLabs
                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ONMZACOW\random[3].exe52%ReversingLabsWin32.Ransomware.FileCrypt
                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[1].exe48%ReversingLabsWin64.Trojan.Generic
                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[3].exe37%ReversingLabs
                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[4].exe39%ReversingLabsWin32.Infostealer.Jalapeno
                            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[5].exe83%ReversingLabsWin32.Ransomware.FileCrypt
                            C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe48%ReversingLabsWin64.Trojan.Generic
                            C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exe50%ReversingLabsWin32.Trojan.Generic
                            C:\Users\user\AppData\Local\Temp\1033699001\8c9c7a39f7.exe37%ReversingLabs
                            C:\Users\user\AppData\Local\Temp\1033700001\24a1c81f44.exe45%ReversingLabsByteCode-MSIL.Trojan.LummaC
                            C:\Users\user\AppData\Local\Temp\1033702001\31f59e2a09.exe39%ReversingLabsWin32.Infostealer.Jalapeno
                            C:\Users\user\AppData\Local\Temp\1033703001\ba5ccf6bd8.exe11%ReversingLabs
                            C:\Users\user\AppData\Local\Temp\1033704001\a85084d20f.exe52%ReversingLabsWin32.Ransomware.FileCrypt
                            C:\Users\user\AppData\Local\Temp\1033705001\54d18f4f90.exe55%ReversingLabsWin32.Infostealer.Tinba
                            C:\Users\user\AppData\Local\Temp\1033706001\4e6501ac3b.exe83%ReversingLabsWin32.Ransomware.FileCrypt
                            C:\Users\user\AppData\Local\Temp\1033707001\a0d135de95.exe22%ReversingLabs
                            C:\Users\user\AppData\Local\Temp\ITH3569MCVRCZNYE5XQ77V.exe58%ReversingLabsWin32.Infostealer.Tinba
                            C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_ARC4.pyd0%ReversingLabs
                            C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_Salsa20.pyd0%ReversingLabs
                            C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_chacha20.pyd0%ReversingLabs
                            C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_pkcs1_decode.pyd0%ReversingLabs
                            C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_aes.pyd0%ReversingLabs
                            C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_aesni.pyd0%ReversingLabs
                            C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_arc2.pyd0%ReversingLabs
                            C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_blowfish.pyd0%ReversingLabs
                            C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_cast.pyd0%ReversingLabs
                            C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_cbc.pyd0%ReversingLabs
                            C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_cfb.pyd0%ReversingLabs
                            C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_ctr.pyd0%ReversingLabs
                            C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_des.pyd0%ReversingLabs
                            C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_des3.pyd0%ReversingLabs
                            C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_ecb.pyd0%ReversingLabs
                            C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_eksblowfish.pyd0%ReversingLabs

                            Unpacked PE Files

                            ⊘No Antivirus matches

                            Domains

                            ⊘No Antivirus matches

                            URLs

                            SourceDetectionScannerLabelLink
                            https://sputnik-1985.com/apidP.a100%Avira URL Cloudmalware
                            https://community.fas0%Avira URL Cloudsafe
                            https://sputnik-1985.com/apisYE100%Avira URL Cloudmalware
                            https://importlib-metadata.readthedocs.io/0%Avira URL Cloudsafe
                            https://sputnik-1985.com/=k100%Avira URL Cloudmalware
                            http://185.215.113.16/off/def.exe;_cd_0%Avira URL Cloudsafe
                            https://wheel.readthedocs.io/en/stable/news.html0%Avira URL Cloudsafe
                            https://sputnik-1985.com:443/apibe100%Avira URL Cloudmalware
                            https://steamcommunity.co100%Avira URL Cloudphishing
                            https://sputnik-1985.com/apiu(100%Avira URL Cloudmalware
                            http://cacerts.digiX0%Avira URL Cloudsafe
                            https://sputnik-1985.com:443/api100%Avira URL Cloudmalware
                            https://community.fastl90%Avira URL Cloudsafe
                            https://sputnik-1985.com/apiG100%Avira URL Cloudmalware
                            https://community.fastly.stea0%Avira URL Cloudsafe
                            https://tidelift.com/subscription/pkg/pypi-importlib-metadata?utm_source=pypi-importlib-metadata&utm0%Avira URL Cloudsafe
                            https://sputnik-1985.com/D100%Avira URL Cloudmalware
                            https://sputnik-1985.com/apiS100%Avira URL Cloudmalware
                            https://sputnik-1985.com/l100%Avira URL Cloudmalware
                            http://185.215.113.16/off/def.exestat0%Avira URL Cloudsafe

                            Domains and IPs

                            Contacted Domains

                            ⊘No contacted domains info

                            Contacted URLs

                            NameMaliciousAntivirus DetectionReputation
                            rabidcowse.shopfalse
                              		high
                              nearycrepso.shopfalse
                                		high

                                URLs from Memory and Binaries

                                NameSourceMaliciousAntivirus DetectionReputation
                                https://steamcommunity.com/linkficf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://duckduckgo.com/chrome_newtabe0ac53ba53.exe, 00000015.00000003.2136075338.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2135809145.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2135567631.00000000058EE000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2214275467.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2214000185.0000000005B6D000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    https://duckduckgo.com/ac/?q=e0ac53ba53.exe, 00000015.00000003.2136075338.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2135809145.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2135567631.00000000058EE000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2214275467.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2214000185.0000000005B6D000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      https://github.com/astral-sh/ruffc061393b55.exe, 00000009.00000003.2002397575.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&ampe0ac53ba53.exe, 00000015.00000003.2123524420.000000000120D000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2386293420.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          https://github.com/python/importlib_metadata/actions/workflows/main.yml/badge.svgc061393b55.exe, 00000009.00000003.2002397575.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://community.fastly.steamstcf4bd6029c.exe, 00000016.00000003.2300941183.0000000001461000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2328481395.0000000001461000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://github.com/python/importlib_metadata/issuesc061393b55.exe, 00000009.00000003.2002397575.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#c061393b55.exe, 0000000A.00000003.2009187642.00000200D35DF000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2009919760.00000200D35D0000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2010438253.00000200D35DE000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2009512862.00000200D35D0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://wheel.readthedocs.io/en/stable/news.htmlc061393b55.exe, 00000009.00000003.2003163720.0000020D0AFC7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://importlib-metadata.readthedocs.io/c061393b55.exe, 00000009.00000003.2002397575.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://contile-images.services.mozilla.com/5b4DH7KHAf2n_mNaLjNi1-UAoKmM9rhqaA9w7FyznHo.10943.jpge0ac53ba53.exe, 00000015.00000003.2182075458.0000000005930000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://www.valvesoftware.com/legal.htme0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64c061393b55.exe, 0000000A.00000003.2013216168.00000200D3956000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2015713624.00000200D3956000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2012943211.00000200D3956000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2015079597.00000200D3956000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2014154422.00000200D3956000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2016222955.00000200D3956000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2011995088.00000200D3956000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2016659534.00000200D3956000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1696497267574.12791&key=1696497267400700e0ac53ba53.exe, 00000015.00000003.2182075458.0000000005930000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://readthedocs.org/projects/importlib-metadata/badge/?version=latestc061393b55.exe, 00000009.00000003.2002397575.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedbacke0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://community.fastly.steamstatic.com/public/css/skin_1/modacf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2386293420.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://blog.jaraco.com/skeletonc061393b55.exe, 00000009.00000003.2002397575.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&amp;l=englise0ac53ba53.exe, 00000015.00000003.2123524420.000000000120D000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbCe0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2385193919.000000000145D000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1696497267574.12791&key=1696497267400700002.1&ctae0ac53ba53.exe, 00000015.00000003.2182075458.0000000005930000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRie0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://github.com/pypa/.github/blob/main/CODE_OF_CONDUCT.mdc061393b55.exe, 00000009.00000003.2003163720.0000020D0AFC7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr;c061393b55.exe, 0000000A.00000003.2011159095.00000200D395F000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2011159095.00000200D3920000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filenamec061393b55.exe, 0000000A.00000003.2009187642.00000200D35DF000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2009919760.00000200D35D0000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2010438253.00000200D35DE000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2009512862.00000200D35D0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://steamcommunity.com/profiles/76561199724331900e0ac53ba53.exe, 00000015.00000003.2122754416.00000000011D4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&amp;l=ene0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2385193919.000000000145D000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://github.com/pypa/wheelc061393b55.exe, 00000009.00000003.2003163720.0000020D0AFC7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://www.python.org/dev/peps/pep-0427/c061393b55.exe, 00000009.00000003.2003163720.0000020D0AFC7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readerc061393b55.exe, 0000000A.00000003.2009187642.00000200D35DF000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2009919760.00000200D35D0000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2010438253.00000200D35DE000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2009512862.00000200D35D0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://github.com/python/cpython/issues/86361.c061393b55.exe, 0000000A.00000003.2013381002.00000200D3870000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2017270583.00000200D3870000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2015929025.00000200D3870000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2012943211.00000200D3870000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2015459372.00000200D3870000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2011705665.00000200D3C7B000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2013548335.00000200D3881000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=e0ac53ba53.exe, 00000015.00000003.2136075338.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2135809145.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2135567631.00000000058EE000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2214275467.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2214000185.0000000005B6D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://ocsp.rootca1.amazontrust.com0:e0ac53ba53.exe, 00000015.00000003.2177654462.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2264083329.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://www.ecosia.org/newtab/e0ac53ba53.exe, 00000015.00000003.2136075338.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2135809145.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2135567631.00000000058EE000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2214275467.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2214000185.0000000005B6D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://steamcommunity.com/profiles/76561199724331900/inventory/e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://img.shields.io/badge/skeleton-2024-informationalc061393b55.exe, 00000009.00000003.2002397575.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&amp;l=engcf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            https://sputnik-1985.com/=kcf4bd6029c.exe, 00000016.00000003.2300615762.000000000146F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            • Avira URL Cloud: malware
                                                                                                            		unknown
                                                                                                            https://community.fae0ac53ba53.exe, 00000015.00000003.2211666253.0000000001253000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEcf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2386293420.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&amp;l=english&ame0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2385193919.000000000145D000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.#Ucf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    http://185.215.113.16/off/def.exe;_cd_e0ac53ba53.exe, 00000015.00000003.2402936438.0000000001258000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2403897693.000000000125A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    • Avira URL Cloud: safe
                                                                                                                    		unknown
                                                                                                                    https://img.shields.io/pypi/v/importlib_metadata.svgc061393b55.exe, 00000009.00000003.2002397575.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      http://185.215.113.16/off/def.exee0ac53ba53.exe, 00000015.00000003.2403897693.000000000125A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://community.fascf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2386293420.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        • Avira URL Cloud: safe
                                                                                                                        		unknown
                                                                                                                        https://mahler:8092/site-updates.pyc061393b55.exe, 0000000A.00000003.2016384535.00000200D3CAD000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2016968942.00000200D3C05000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://sputnik-1985.com/apidP.ae0ac53ba53.exe, 00000015.00000003.2123524420.000000000120D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          • Avira URL Cloud: malware
                                                                                                                          		unknown
                                                                                                                          https://tools.ietf.org/html/rfc7231#section-4.3.6)c061393b55.exe, 0000000A.00000003.2016801906.00000200D3D4F000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2018241146.00000200D3D46000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2017650493.00000200D3D58000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2018067959.00000200D3D6C000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2016801906.00000200D3D5F000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2017986400.00000200D3D58000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://sputnik-1985.com/apisYEcf4bd6029c.exe, 00000016.00000003.2261072491.0000000005B31000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2265081690.0000000005B31000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                            • Avira URL Cloud: malware
                                                                                                                            		unknown
                                                                                                                            https://help.steampowered.com/en/e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://sputnik-1985.com:443/apibecf4bd6029c.exe, 00000016.00000003.2299582589.0000000001480000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              • Avira URL Cloud: malware
                                                                                                                              		unknown
                                                                                                                              https://sputnik-1985.com/apiu(e0ac53ba53.exe, 00000015.00000003.2402936438.0000000001258000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2240142291.0000000001258000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2403897693.000000000125A000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2253717755.0000000001255000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              • Avira URL Cloud: malware
                                                                                                                              		unknown
                                                                                                                              https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_datac061393b55.exe, 0000000A.00000003.2009187642.00000200D35DF000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2009919760.00000200D35D0000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2010438253.00000200D35DE000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2009512862.00000200D35D0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://steamcommunity.cocf4bd6029c.exe, 00000016.00000003.2300941183.0000000001461000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                • Avira URL Cloud: phishing
                                                                                                                                		unknown
                                                                                                                                https://github.com/python/importlib_metadata/actions?query=workflow%3A%22tests%22c061393b55.exe, 00000009.00000003.2002397575.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.pnge0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&amp;l=english&acf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2386293420.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      http://x1.c.lencr.org/0e0ac53ba53.exe, 00000015.00000003.2177654462.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2264083329.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        http://x1.i.lencr.org/0e0ac53ba53.exe, 00000015.00000003.2177654462.00000000059BD000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2264083329.0000000005BE6000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqrfQHr4pbW4ZbWfpbY7ReNxR3UIG8zInwYIFIVs9eYie0ac53ba53.exe, 00000015.00000003.2182075458.0000000005930000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://community.fastly.steamstatic.com/public/shared/csse0ac53ba53.exe, 00000015.00000003.2123524420.000000000120D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              http://cacerts.digiXc061393b55.exe, 00000009.00000003.2004321815.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 00000009.00000003.1989355560.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              • Avira URL Cloud: safe
                                                                                                                                              		unknown
                                                                                                                                              https://sputnik-1985.com:443/apie0ac53ba53.exe, e0ac53ba53.exe, 00000015.00000003.2176064084.000000000592E000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2176304559.000000000592E000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2176446364.000000000592E000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2252886391.0000000005931000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2386196260.0000000001480000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2259495619.0000000005BB2000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2370059128.0000000001480000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.0000000001407000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              • Avira URL Cloud: malware
                                                                                                                                              		unknown
                                                                                                                                              https://community.fastl9e0ac53ba53.exe, 00000015.00000003.2211666253.0000000001253000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              • Avira URL Cloud: safe
                                                                                                                                              		unknown
                                                                                                                                              https://steamcommunity.com/workshop/e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                https://support.mozilla.org/products/firefoxgro.alle0ac53ba53.exe, 00000015.00000003.2180936760.0000000005BD8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&amp;l=english&amp;_ce0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://store.steampowered.com/legal/e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2196857322.0000000001470000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://sputnik-1985.com/apiGcf4bd6029c.exe, 00000016.00000003.2482960425.000000000144E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      • Avira URL Cloud: malware
                                                                                                                                                      		unknown
                                                                                                                                                      https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&amp;l=ene0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2385193919.000000000145D000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&amp;l=enge0ac53ba53.exe, 00000015.00000003.2123524420.000000000120D000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          https://pypi.org/project/setuptools/c061393b55.exe, 00000009.00000003.2003163720.0000020D0AFC7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/c061393b55.exe, 0000000A.00000003.2016296141.00000200D38FA000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2017404603.00000200D392B000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2015079597.00000200D38FD000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2016878815.00000200D3907000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              https://www.google.com/images/branding/product/ico/googleg_lodp.icoe0ac53ba53.exe, 00000015.00000003.2136075338.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2135809145.00000000058EB000.00000004.00000800.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2135567631.00000000058EE000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2214275467.0000000005B6B000.00000004.00000800.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2214000185.0000000005B6D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                https://community.fastly.steacf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                • Avira URL Cloud: safe
                                                                                                                                                                		unknown
                                                                                                                                                                https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&amp;l=english&ae0ac53ba53.exe, 00000015.00000003.2123524420.000000000120D000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2197558404.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2385193919.000000000145D000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2312742082.000000000144E000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2299818266.000000000144E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&amp;l=engle0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    https://www.python.org/c061393b55.exe, 0000000A.00000003.2016384535.00000200D3CAD000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2016968942.00000200D3C05000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      https://sputnik-1985.com/Dcf4bd6029c.exe, 00000016.00000003.2299818266.0000000001418000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      • Avira URL Cloud: malware
                                                                                                                                                                      		unknown
                                                                                                                                                                      http://185.215.113.16/steam/random.execf4bd6029c.exe, 00000016.00000003.2473339717.0000000001466000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        https://sputnik-1985.com/apiScf4bd6029c.exe, 00000016.00000003.2473339717.0000000001466000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        • Avira URL Cloud: malware
                                                                                                                                                                        		unknown
                                                                                                                                                                        https://store.steampowered.com/e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          https://tidelift.com/subscription/pkg/pypi-importlib-metadata?utm_source=pypi-importlib-metadata&utmc061393b55.exe, 00000009.00000003.2002397575.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          • Avira URL Cloud: safe
                                                                                                                                                                          		unknown
                                                                                                                                                                          https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15e498ec2b39921665a1fbc954bff40a8106629178eadc64e0ac53ba53.exe, 00000015.00000003.2182075458.0000000005930000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.pnge0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpge0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                https://community.fastly.steamstatic.com/pe0ac53ba53.exe, 00000015.00000003.2123524420.000000000120D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  http://185.215.113.16/e0ac53ba53.exe, e0ac53ba53.exe, 00000015.00000003.2402936438.0000000001258000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2403897693.000000000125A000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2473339717.0000000001466000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    https://sputnik-1985.com/lcf4bd6029c.exe, 00000016.00000003.2326932620.0000000001469000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                    • Avira URL Cloud: malware
                                                                                                                                                                                    		unknown
                                                                                                                                                                                    https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpge0ac53ba53.exe, 00000015.00000003.2182075458.0000000005930000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      http://185.215.113.16/off/def.exestate0ac53ba53.exe, 00000015.00000003.2402936438.0000000001258000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2403897693.000000000125A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                      • Avira URL Cloud: safe
                                                                                                                                                                                      		unknown
                                                                                                                                                                                      https://www.openssl.org/Hc061393b55.exe, 00000009.00000003.1996177520.0000020D0AFC4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&ampe0ac53ba53.exe, 00000015.00000003.2123524420.000000000120D000.00000004.00000020.00020000.00000000.sdmp, e0ac53ba53.exe, 00000015.00000003.2122630940.0000000001255000.00000004.00000020.00020000.00000000.sdmp, cf4bd6029c.exe, 00000016.00000003.2185579285.000000000144E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr;rc061393b55.exe, 0000000A.00000003.2011159095.00000200D395F000.00000004.00000020.00020000.00000000.sdmp, c061393b55.exe, 0000000A.00000003.2011159095.00000200D3920000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		high

                                                                                                                                                                                            World Map of Contacted IPs

                                                                                                                                                                                            • No. of IPs < 25%
                                                                                                                                                                                            • 25% < No. of IPs < 50%
                                                                                                                                                                                            • 50% < No. of IPs < 75%
                                                                                                                                                                                            • 75% < No. of IPs

                                                                                                                                                                                            Public IPs

                                                                                                                                                                                            IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                            185.215.113.43
                                                                                                                                                                                            		unknownPortugal
                                                                                                                                                                                            		206894WHOLESALECONNECTIONSNLtrue
                                                                                                                                                                                            104.26.9.59
                                                                                                                                                                                            		unknownUnited States
                                                                                                                                                                                            		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                            1.1.1.1
                                                                                                                                                                                            		unknownAustralia
                                                                                                                                                                                            		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                            142.250.185.206
                                                                                                                                                                                            		unknownUnited States
                                                                                                                                                                                            		15169GOOGLEUSfalse
                                                                                                                                                                                            20.42.65.92
                                                                                                                                                                                            		unknownUnited States
                                                                                                                                                                                            		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                            185.215.113.16
                                                                                                                                                                                            		unknownPortugal
                                                                                                                                                                                            		206894WHOLESALECONNECTIONSNLfalse
                                                                                                                                                                                            149.154.167.220
                                                                                                                                                                                            		unknownUnited Kingdom
                                                                                                                                                                                            		62041TELEGRAMRUfalse
                                                                                                                                                                                            104.21.112.1
                                                                                                                                                                                            		unknownUnited States
                                                                                                                                                                                            		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                            142.250.185.163
                                                                                                                                                                                            		unknownUnited States
                                                                                                                                                                                            		15169GOOGLEUSfalse
                                                                                                                                                                                            185.156.73.23
                                                                                                                                                                                            		unknownRussian Federation
                                                                                                                                                                                            		48817RELDAS-NETRUfalse
                                                                                                                                                                                            188.114.96.3
                                                                                                                                                                                            		unknownEuropean Union
                                                                                                                                                                                            		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                            104.102.49.254
                                                                                                                                                                                            		unknownUnited States
                                                                                                                                                                                            		16625AKAMAI-ASUSfalse
                                                                                                                                                                                            185.215.113.206
                                                                                                                                                                                            		unknownPortugal
                                                                                                                                                                                            		206894WHOLESALECONNECTIONSNLfalse
                                                                                                                                                                                            64.233.184.84
                                                                                                                                                                                            		unknownUnited States
                                                                                                                                                                                            		15169GOOGLEUSfalse
                                                                                                                                                                                            31.41.244.11
                                                                                                                                                                                            		unknownRussian Federation
                                                                                                                                                                                            		61974AEROEXPRESS-ASRUfalse

                                                                                                                                                                                            Private

                                                                                                                                                                                            IP
                                                                                                                                                                                            127.0.0.1

                                                                                                                                                                                            General Information

                                                                                                                                                                                            Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                            Analysis ID:1585286
                                                                                                                                                                                            Start date and time:2025-01-07 13:17:14 +01:00
                                                                                                                                                                                            Joe Sandbox product:CloudBasic
                                                                                                                                                                                            Overall analysis duration:0h 20m 35s
                                                                                                                                                                                            Hypervisor based Inspection enabled:false
                                                                                                                                                                                            Report type:full
                                                                                                                                                                                            Cookbook file name:default.jbs
                                                                                                                                                                                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                            Number of analysed new started processes analysed:59
                                                                                                                                                                                            Number of new started drivers analysed:2
                                                                                                                                                                                            Number of existing processes analysed:0
                                                                                                                                                                                            Number of existing drivers analysed:0
                                                                                                                                                                                            Number of injected processes analysed:0
                                                                                                                                                                                            Technologies:
                                                                                                                                                                                            • HCA enabled
                                                                                                                                                                                            • EGA enabled
                                                                                                                                                                                            • AMSI enabled
                                                                                                                                                                                            Analysis Mode:default
                                                                                                                                                                                            Sample name:file.exe
                                                                                                                                                                                            Detection:MAL
                                                                                                                                                                                            Classification:mal100.troj.spyw.evad.winEXE@119/177@0/16
                                                                                                                                                                                            EGA Information:
                                                                                                                                                                                            • Successful, ratio: 83.3%
                                                                                                                                                                                            HCA Information:Failed
                                                                                                                                                                                            Cookbook Comments:
                                                                                                                                                                                            • Found application associated with file extension: .exe
                                                                                                                                                                                            • Override analysis time to 240000 for current running targets taking high CPU consumption

                                                                                                                                                                                            Warnings

                                                                                                                                                                                            • Max analysis timeout: 600s exceeded, the analysis took too long
                                                                                                                                                                                            • Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
                                                                                                                                                                                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, dllhost.exe, SIHClient.exe, conhost.exe, svchost.exe
                                                                                                                                                                                            • Execution Graph export aborted for target e0ac53ba53.exe, PID 6660 because there are no executed function
                                                                                                                                                                                            • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                            • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                                                                            • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                            • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                                                                                                                                                                            • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                                                            • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                                                                            • Report size getting too big, too many NtOpenKey calls found.
                                                                                                                                                                                            • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                            • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                            • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                                                                                                                                            • Report size getting too big, too many NtQueryDirectoryFile calls found.
                                                                                                                                                                                            • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                            • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                                                            • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                                                                                                            • Skipping network analysis since amount of network traffic is too extensive

                                                                                                                                                                                            Simulations

                                                                                                                                                                                            Behavior and APIs

                                                                                                                                                                                            TimeTypeDescription
                                                                                                                                                                                            07:19:02API Interceptor18110328x Sleep call for process: skotes.exe modified
                                                                                                                                                                                            07:19:26API Interceptor7x Sleep call for process: db0740f8e4.exe modified
                                                                                                                                                                                            07:19:31API Interceptor8643x Sleep call for process: e0ac53ba53.exe modified
                                                                                                                                                                                            07:19:37API Interceptor110x Sleep call for process: cf4bd6029c.exe modified
                                                                                                                                                                                            07:19:43API Interceptor1x Sleep call for process: WerFault.exe modified
                                                                                                                                                                                            07:20:06API Interceptor381x Sleep call for process: 05c06146f2.exe modified
                                                                                                                                                                                            07:20:30API Interceptor177733x Sleep call for process: b3206cdf20.exe modified
                                                                                                                                                                                            13:18:23Task SchedulerRun new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                            13:19:41AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run cf4bd6029c.exe C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exe
                                                                                                                                                                                            13:19:49AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 05c06146f2.exe C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe
                                                                                                                                                                                            13:19:58AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 959ae18948.exe C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exe
                                                                                                                                                                                            13:20:07AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run caf9f1bef3.exe C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exe
                                                                                                                                                                                            13:20:17AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run cf4bd6029c.exe C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exe
                                                                                                                                                                                            13:20:32AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 05c06146f2.exe C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe
                                                                                                                                                                                            13:20:45AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 959ae18948.exe C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exe
                                                                                                                                                                                            13:20:47Task SchedulerRun new task: Gxtuum path: C:\Users\user\AppData\Local\Temp\ce48d5f5a7\Gxtuum.exe
                                                                                                                                                                                            13:20:57AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run caf9f1bef3.exe C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exe
                                                                                                                                                                                            13:21:17Task SchedulerRun new task: HpUpdate path: C:\Users\user\AppData\Roaming\clichannel_test\msn.exe
                                                                                                                                                                                            13:21:17Task SchedulerRun new task: watcherChrome_rcc_4 path: C:\Users\user\AppData\Roaming\clichannel_test\msn.exe
                                                                                                                                                                                            13:25:34AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 71c49c09f3.exe C:\Users\user\AppData\Local\Temp\1033710001\71c49c09f3.exe
                                                                                                                                                                                            13:25:42AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run a8ee70bf76.exe C:\Users\user\AppData\Local\Temp\1033711001\a8ee70bf76.exe
                                                                                                                                                                                            13:25:51AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 5a8e114648.exe C:\Users\user\AppData\Local\Temp\1033712001\5a8e114648.exe
                                                                                                                                                                                            13:25:59AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run e9a751f949.exe C:\Users\user\AppData\Local\Temp\1033713001\e9a751f949.exe
                                                                                                                                                                                            13:26:08AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 71c49c09f3.exe C:\Users\user\AppData\Local\Temp\1033710001\71c49c09f3.exe
                                                                                                                                                                                            13:26:16AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run a8ee70bf76.exe C:\Users\user\AppData\Local\Temp\1033711001\a8ee70bf76.exe
                                                                                                                                                                                            13:26:24AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 5a8e114648.exe C:\Users\user\AppData\Local\Temp\1033712001\5a8e114648.exe
                                                                                                                                                                                            13:26:32AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run e9a751f949.exe C:\Users\user\AppData\Local\Temp\1033713001\e9a751f949.exe

                                                                                                                                                                                            Joe Sandbox View / Context

                                                                                                                                                                                            IPs

                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                            185.215.113.43file.exeGet hashmaliciousAmadey, Babadeda, LummaC Stealer, Poverty Stealer, PureLog StealerBrowse
                                                                                                                                                                                            • 185.215.113.43/Zu7JuNko/index.php
                                                                                                                                                                                            same.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, Stealc, Vidar, XWormBrowse
                                                                                                                                                                                            • 185.215.113.43/Zu7JuNko/index.php
                                                                                                                                                                                            ebjtOH70jl.exeGet hashmaliciousLummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                                            • 185.215.113.43/Zu7JuNko/index.php
                                                                                                                                                                                            Fi3ptS6O8D.exeGet hashmaliciousAmadeyBrowse
                                                                                                                                                                                            • 185.215.113.43/Zu7JuNko/index.php
                                                                                                                                                                                            Dl6wuWiQdg.exeGet hashmaliciousLummaC, Amadey, LummaC StealerBrowse
                                                                                                                                                                                            • 185.215.113.43/Zu7JuNko/index.php
                                                                                                                                                                                            o0cabS0OQn.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, StealcBrowse
                                                                                                                                                                                            • 185.215.113.43/Zu7JuNko/index.php
                                                                                                                                                                                            mDuCbT8LnH.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, StealcBrowse
                                                                                                                                                                                            • 185.215.113.43/Zu7JuNko/index.php
                                                                                                                                                                                            vVJvxAfBDM.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, StealcBrowse
                                                                                                                                                                                            • 185.215.113.43/Zu7JuNko/index.php
                                                                                                                                                                                            LIWYEYWSOj.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, StealcBrowse
                                                                                                                                                                                            • 185.215.113.43/Zu7JuNko/index.php
                                                                                                                                                                                            8WRONDszv4.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRATBrowse
                                                                                                                                                                                            • 185.215.113.43/Zu7JuNko/index.php
                                                                                                                                                                                            104.26.9.59LightSpoofer.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                              Nexus-Executor.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                WaveExecutor.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  Nexus-Executor.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    Fortexternal.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      Fortexternal.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          file.exeGet hashmaliciousLummaC, Ailurophile Stealer, Amadey, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                            ZoomInstaller.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                              ZoomInstaller.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                Domains

                                                                                                                                                                                                                ⊘No context

                                                                                                                                                                                                                ASNs

                                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                CLOUDFLARENETUSENQ-0092025.docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                                                                                • 188.114.97.3
                                                                                                                                                                                                                Quarantined Messages(3).zipGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                • 188.114.96.3
                                                                                                                                                                                                                U1P3u1tkB2.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                • 104.21.80.209
                                                                                                                                                                                                                LVkAi4PBv6.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                • 188.114.97.3
                                                                                                                                                                                                                U1P3u1tkB2.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                • 104.21.80.209
                                                                                                                                                                                                                64pOGv7k4N.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                • 188.114.97.3
                                                                                                                                                                                                                BnJxmraqlk.exeGet hashmaliciousLummaC, PrivateLoaderBrowse
                                                                                                                                                                                                                • 104.21.48.1
                                                                                                                                                                                                                https://rebrand.ly/3d446fGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                • 104.26.5.15
                                                                                                                                                                                                                DHL DOCS 2-0106-25.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                                • 172.67.148.216
                                                                                                                                                                                                                Sales Acknowledgement - HES #982323.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                • 104.16.123.96
                                                                                                                                                                                                                WHOLESALECONNECTIONSNLfile.exeGet hashmaliciousAmadey, Babadeda, LummaC Stealer, Poverty Stealer, PureLog StealerBrowse
                                                                                                                                                                                                                • 185.215.113.16
                                                                                                                                                                                                                same.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, Stealc, Vidar, XWormBrowse
                                                                                                                                                                                                                • 185.215.113.206
                                                                                                                                                                                                                ebjtOH70jl.exeGet hashmaliciousLummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                                • 185.215.113.206
                                                                                                                                                                                                                Fi3ptS6O8D.exeGet hashmaliciousAmadeyBrowse
                                                                                                                                                                                                                • 185.215.113.43
                                                                                                                                                                                                                random(4).exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                                • 185.215.113.206
                                                                                                                                                                                                                random(6).exeGet hashmaliciousStealcBrowse
                                                                                                                                                                                                                • 185.215.113.206
                                                                                                                                                                                                                EdYEXasNiR.exeGet hashmaliciousLummaC, Amadey, Babadeda, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                                • 185.215.113.206
                                                                                                                                                                                                                SMmAznmdAa.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                • 185.215.113.16
                                                                                                                                                                                                                5EfYBe3nch.exeGet hashmaliciousLummaC, Amadey, Babadeda, LiteHTTP Bot, LummaC Stealer, Poverty Stealer, StealcBrowse
                                                                                                                                                                                                                • 185.215.113.206
                                                                                                                                                                                                                zhMQ0hNEmb.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                • 185.215.113.16
                                                                                                                                                                                                                CLOUDFLARENETUSENQ-0092025.docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                                                                                • 188.114.97.3
                                                                                                                                                                                                                Quarantined Messages(3).zipGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                • 188.114.96.3
                                                                                                                                                                                                                U1P3u1tkB2.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                • 104.21.80.209
                                                                                                                                                                                                                LVkAi4PBv6.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                • 188.114.97.3
                                                                                                                                                                                                                U1P3u1tkB2.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                • 104.21.80.209
                                                                                                                                                                                                                64pOGv7k4N.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                • 188.114.97.3
                                                                                                                                                                                                                BnJxmraqlk.exeGet hashmaliciousLummaC, PrivateLoaderBrowse
                                                                                                                                                                                                                • 104.21.48.1
                                                                                                                                                                                                                https://rebrand.ly/3d446fGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                • 104.26.5.15
                                                                                                                                                                                                                DHL DOCS 2-0106-25.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                                • 172.67.148.216
                                                                                                                                                                                                                Sales Acknowledgement - HES #982323.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                • 104.16.123.96
                                                                                                                                                                                                                MICROSOFT-CORP-MSN-AS-BLOCKUSQuarantined Messages(3).zipGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                • 52.109.28.46
                                                                                                                                                                                                                LVkAi4PBv6.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                • 204.79.197.219
                                                                                                                                                                                                                file_83f986ef2d0592ef993924a8cc5b8d6a_2025-01-07_10_04_01_718000.zipGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                • 52.113.194.132
                                                                                                                                                                                                                Mansourbank Swift-TT379733 Report.svgGet hashmaliciousBranchlock ObfuscatorBrowse
                                                                                                                                                                                                                • 204.79.197.203
                                                                                                                                                                                                                Mansourbank Swift-TT680169 Report.svgGet hashmaliciousBranchlock ObfuscatorBrowse
                                                                                                                                                                                                                • 204.79.197.203
                                                                                                                                                                                                                Mes_Drivers_3.0.4.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                • 40.76.134.238
                                                                                                                                                                                                                https://147y3.trk.elasticemail.com/tracking/click?d=l6DX1ZxoYxoIu3Ps_nHCw2dpTGYsp50KhPgdcLAPZ98lDQqXluI2jbk2Kz6cWaRjWchw5Igbhe-BSjXhcIk5khB6_31XWJ3KxF070e3rxxM9hJmShBhAM7tP0jesqnjYkgFpEuivEIV6QQKt0-F18YQ1#out/0023m/435/85jy1/26p0/41/77Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                • 52.191.212.24
                                                                                                                                                                                                                Mes_Drivers_3.0.4.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                • 20.13.96.71
                                                                                                                                                                                                                miori.x86.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                • 22.35.211.83
                                                                                                                                                                                                                x86_64.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                • 51.111.190.47

                                                                                                                                                                                                                JA3 Fingerprints

                                                                                                                                                                                                                ⊘No context

                                                                                                                                                                                                                Dropped Files

                                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                C:\ProgramData\freebl3.dllsame.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, Stealc, Vidar, XWormBrowse
                                                                                                                                                                                                                  random(4).exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                                    EdYEXasNiR.exeGet hashmaliciousLummaC, Amadey, Babadeda, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                                      5EfYBe3nch.exeGet hashmaliciousLummaC, Amadey, Babadeda, LiteHTTP Bot, LummaC Stealer, Poverty Stealer, StealcBrowse
                                                                                                                                                                                                                        random.exeGet hashmaliciousStealc, VidarBrowse
                                                                                                                                                                                                                          8WFJ38EJo5.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                                            w22319us3M.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar, zgRATBrowse
                                                                                                                                                                                                                              5uVReRlvME.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Remcos, StealcBrowse
                                                                                                                                                                                                                                DRWgoZo325.exeGet hashmaliciousLummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                                                  i8Vwc7iOaG.exeGet hashmaliciousLummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, StormKitty, VidarBrowse
                                                                                                                                                                                                                                    C:\ProgramData\mozglue.dllsame.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, Stealc, Vidar, XWormBrowse
                                                                                                                                                                                                                                      ebjtOH70jl.exeGet hashmaliciousLummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                                                        random(4).exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                                                          EdYEXasNiR.exeGet hashmaliciousLummaC, Amadey, Babadeda, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                                                            5EfYBe3nch.exeGet hashmaliciousLummaC, Amadey, Babadeda, LiteHTTP Bot, LummaC Stealer, Poverty Stealer, StealcBrowse
                                                                                                                                                                                                                                              random.exeGet hashmaliciousStealc, VidarBrowse
                                                                                                                                                                                                                                                8WFJ38EJo5.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                                                                  w22319us3M.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar, zgRATBrowse
                                                                                                                                                                                                                                                    5uVReRlvME.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Remcos, StealcBrowse
                                                                                                                                                                                                                                                      DRWgoZo325.exeGet hashmaliciousLummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, VidarBrowse

                                                                                                                                                                                                                                                        Created / dropped Files

                                                                                                                                                                                                                                                        C:\ProgramData\AFIEGIECGCBKFIEBGCAAFIEBFC

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe
                                                                                                                                                                                                                                                        File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):5242880
                                                                                                                                                                                                                                                        Entropy (8bit):0.03799545499236577
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:192:58rJQaXoMXp0VW9FxWZru/bNb/fc3DDTnHI:58r54w0VW3xWZrwbFHc3T
                                                                                                                                                                                                                                                        MD5:96AB9233CA2AB3982F98B1BA44CFFE32
                                                                                                                                                                                                                                                        SHA1:A72C6AF1881274392B7D73594D78C4D3F1B91428
                                                                                                                                                                                                                                                        SHA-256:C764FE5DA2665335A3C2E60091F08E21A16CEC35EFD453AE092FEB1D7C3D69BC
                                                                                                                                                                                                                                                        SHA-512:E09E96834C049E56FE5E9A56BA1635CA6A4FB5DF2F2EB8F339C94D4BCF2D24150592B2833D084BD4BD7D0319B4D5C493B5B49A64310E084684375D645DD8CEEC
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\ProgramData\GCAEHDBAAECBFHJKFCFB

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe
                                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):40960
                                                                                                                                                                                                                                                        Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                                        MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                                        SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                                        SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                                        SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\ProgramData\GCGHIIDH

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe
                                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):196608
                                                                                                                                                                                                                                                        Entropy (8bit):1.1211596417522893
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8wH0hL3kWieF:r2qOB1nxCkvSAELyKOMq+8wH0hLUZs
                                                                                                                                                                                                                                                        MD5:0AB67F0950F46216D5590A6A41A267C7
                                                                                                                                                                                                                                                        SHA1:3E0DD57E2D4141A54B1C42DD8803C2C4FD26CB69
                                                                                                                                                                                                                                                        SHA-256:4AE2FD6D1BEDB54610134C1E58D875AF3589EDA511F439CDCCF230096C1BEB00
                                                                                                                                                                                                                                                        SHA-512:D19D99A54E7C7C85782D166A3010ABB620B32C7CD6C43B783B2F236492621FDD29B93A52C23B1F4EFC9BF998E1EF1DFEE953E78B28DF1B06C24BADAD750E6DF7
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\ProgramData\HJKJKKKJJJKJKFHJJJJECBFCGH

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe
                                                                                                                                                                                                                                                        File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):98304
                                                                                                                                                                                                                                                        Entropy (8bit):0.08235737944063153
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                                                                                                                                                                                                        MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                                                                                                                                                                                                        SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                                                                                                                                                                                                        SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                                                                                                                                                                                                        SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\ProgramData\IEBFIEBA

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe
                                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):106496
                                                                                                                                                                                                                                                        Entropy (8bit):1.1368932887859682
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cF/k4:MnlyfnGtxnfVuSVumEHFs4
                                                                                                                                                                                                                                                        MD5:9A534FD57BED1D3E9815232E05CCF696
                                                                                                                                                                                                                                                        SHA1:916474D7D073A4EB52A2EF8F7D9EF9549C0808A1
                                                                                                                                                                                                                                                        SHA-256:7BB87D8BC8D49EECAB122B7F5BCD9E77F77B36C6DB173CB41E83A2CCA3AC391B
                                                                                                                                                                                                                                                        SHA-512:ADE77FBBDE6882EF458A43F301AD84B12B42D82E222FC647A78E5709554754714DB886523A639C78D05BC221D608F0F99266D89165E78F76B21083002BE8AEFF
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\ProgramData\JDAFHCGIJECFHIDGDBKE

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe
                                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (1808), with CRLF line terminators
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):10780
                                                                                                                                                                                                                                                        Entropy (8bit):5.490003400075434
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:192:HnBRNC3YbBp6lR1+PaX56/x8lCz9/3/OHNBw8MXSl:Oee1M/xbUPw70
                                                                                                                                                                                                                                                        MD5:573E3493A89E569800F845C62085E9AD
                                                                                                                                                                                                                                                        SHA1:A5F018A1F094B5DBD42B31CE60F7E7170CFF29D8
                                                                                                                                                                                                                                                        SHA-256:9D4B7FFDA8ED67F8205701A36EC908BA7B099C058A75E5073F761362D9B729B8
                                                                                                                                                                                                                                                        SHA-512:3207F9F8964B77883803D6A3622A53D08D8C8BA94186B3751492378E220A2ED37A557B0E084F06F27F435F814FF2F2F09D2A55B169A2725E3BA8576379DFAB3E
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Preview:// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "ecedec8f-7097-47fc-a9e3-d74f0c8e2503");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696499493);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696499494);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

                                                                                                                                                                                                                                                        C:\ProgramData\KJEHJKJEBGHJJKEBGIEC

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe
                                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):51200
                                                                                                                                                                                                                                                        Entropy (8bit):0.8746135976761988
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                                                                                                                                                                                                        MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                                                                                                                                                                                                        SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                                                                                                                                                                                                        SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                                                                                                                                                                                                        SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_db0740f8e4.exe_d16b5cd0b99f65e8d1522b150152dcc592073aa_9e65f04a_7c87384a-7d69-4e7a-b929-e60b6c4b5f3d\Report.wer

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                        File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):65536
                                                                                                                                                                                                                                                        Entropy (8bit):0.8988395542196429
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:96:fbYF2sX+bs3gejTOAqyS3QXIDcQlc6VcEdcw3V+BHUHZ0ownOgHkEwH3dEFYAKcR:MoO+blA0LR3EaGGzuiFcaZ24IO8v
                                                                                                                                                                                                                                                        MD5:39E70F71C9F81308B926FF4DAD34BCBF
                                                                                                                                                                                                                                                        SHA1:B489A03D255145AC0F0C83D0964BFAF42F68634D
                                                                                                                                                                                                                                                        SHA-256:67FD2C77E1E1EF4B319D30B9F55A53C991FF8AA5DFE9B234A174248764E2D698
                                                                                                                                                                                                                                                        SHA-512:DED6654ECF2C0442B4DFC2A5AFBF47B63994583A417F80F76346BADB85BAC783C1A78ECE76950855BDB9F486F050C949C09F05F9A836348E6A6BC277FE9E837C
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.0.7.2.5.9.6.6.6.4.9.3.4.3.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.0.7.2.5.9.6.8.0.2.4.3.4.9.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.c.8.7.3.8.4.a.-.7.d.6.9.-.4.e.7.a.-.b.9.2.9.-.e.6.0.b.6.c.4.b.5.f.3.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.a.1.3.7.8.7.f.-.b.8.b.4.-.4.1.1.c.-.8.6.3.4.-.a.a.b.3.d.e.e.d.c.9.2.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.d.b.0.7.4.0.f.8.e.4...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.H.a.n.d.l.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.6.a.8.-.0.0.0.1.-.0.0.1.3.-.b.b.5.c.-.2.b.6.3.f.e.6.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.b.7.6.0.a.9.d.a.9.4.f.1.f.3.a.d.5.1.8.8.d.7.a.e.e.2.1.7.d.4.7.0.0.0.0.0.0.0.0.!.0.0.0.0.6.9.c.0.3.1.1.f.0.b.1.2.1.e.b.3.7.8.e.9.0.a.1.d.d.8.8.9.2.5.c.4.2.4.c.1.a.0.7.b.!.

                                                                                                                                                                                                                                                        C:\ProgramData\Microsoft\Windows\WER\Temp\WER20F4.tmp.dmp

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                        File Type:Mini DuMP crash report, 15 streams, Tue Jan 7 12:19:26 2025, 0x1205a4 type
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):153511
                                                                                                                                                                                                                                                        Entropy (8bit):3.7174212080449336
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:1536:xUOHtaCV2K+uBojRMpN4uE2aOXkXNLTgbGj7A/RKBzCDXtT6lo1ykCj:RHt5IFa4uEqwLTg8aRH9AMy
                                                                                                                                                                                                                                                        MD5:47981F4BCF87D20CDB5E15C041A49BF2
                                                                                                                                                                                                                                                        SHA1:07608497BF4E6085D030D2E2C0B76C75C2E9CFAD
                                                                                                                                                                                                                                                        SHA-256:44ABD6E70340F357A33557768780E81FE5BF8BC59EBA9A1B611CF86CF8EF5273
                                                                                                                                                                                                                                                        SHA-512:54728776122571A5BD175019E018056FE9BA33D16788439FE31AD27D7E1D75F80109AACEAA46774AEBFAC3A0E40787236952C17A0A5D9027DB56236462BBD244
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Preview:MDMP..a..... .........}g....................................<................/..........`.......8...........T............$...3......................................................................................................eJ......h.......GenuineIntel............T.............}g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\ProgramData\Microsoft\Windows\WER\Temp\WER228B.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                        File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):8366
                                                                                                                                                                                                                                                        Entropy (8bit):3.6915152985465842
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:192:R6l7wVeJE6W6VI86YUb6tegmfgVJN2HprRx89bPf1sfztPm:R6lXJA6686YA6tegmfgVJuenOf0
                                                                                                                                                                                                                                                        MD5:1F0D6718A67FED515813988E13B865BA
                                                                                                                                                                                                                                                        SHA1:74AEB653E33BDBA26EAD93BA7F47D65866373556
                                                                                                                                                                                                                                                        SHA-256:4367181521777FE6CB3C2AFEA446A91E3F6C25D63D90D63052D4DCB452371FF1
                                                                                                                                                                                                                                                        SHA-512:EDAC4A42C50EEC9728075CAA580ED03837A44C529E498FAAAC96B1505626229710532415B2D1CDC12FF5D0543E96E68FBD8FAE9C6915D449E74F125DCCFEF462
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.7.0.4.<./.P.i.

                                                                                                                                                                                                                                                        C:\ProgramData\Microsoft\Windows\WER\Temp\WER2432.tmp.xml

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):4750
                                                                                                                                                                                                                                                        Entropy (8bit):4.445045296417963
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:48:cvIwWl8zsPBJg77aI996WpW8VYtYm8M4JJR0dxPcf6F3j+q8v+R0dxPcfoUQVned:uIjfPTI7T77VxJJRlf4jK+RlfoUQVned
                                                                                                                                                                                                                                                        MD5:706B9E973618928245FE269F84C09E3B
                                                                                                                                                                                                                                                        SHA1:87978EA51807D06FDE54E85F22B33AB105D48507
                                                                                                                                                                                                                                                        SHA-256:37EFADE25411750506205E7B44E2CFD993E383B4A31EEED74996F123DDA9F4C4
                                                                                                                                                                                                                                                        SHA-512:FC44B9E3F2A197449174CF5918485BA8C209E5ED1CD2D2010FF32E9BD5FEB844B076F69711748853489EDE534A0DAB2F5D2FF52C51B56D68EAC235572E601433
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="665482" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                                                                                                                                                                                                        C:\ProgramData\freebl3.dll

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):685392
                                                                                                                                                                                                                                                        Entropy (8bit):6.872871740790978
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
                                                                                                                                                                                                                                                        MD5:550686C0EE48C386DFCB40199BD076AC
                                                                                                                                                                                                                                                        SHA1:EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
                                                                                                                                                                                                                                                        SHA-256:EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
                                                                                                                                                                                                                                                        SHA-512:0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                        Joe Sandbox View:
                                                                                                                                                                                                                                                        • Filename: same.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                        • Filename: random(4).exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                        • Filename: EdYEXasNiR.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                        • Filename: 5EfYBe3nch.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                        • Filename: random.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                        • Filename: 8WFJ38EJo5.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                        • Filename: w22319us3M.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                        • Filename: 5uVReRlvME.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                        • Filename: DRWgoZo325.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                        • Filename: i8Vwc7iOaG.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\ProgramData\mozglue.dll

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):608080
                                                                                                                                                                                                                                                        Entropy (8bit):6.833616094889818
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
                                                                                                                                                                                                                                                        MD5:C8FD9BE83BC728CC04BEFFAFC2907FE9
                                                                                                                                                                                                                                                        SHA1:95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
                                                                                                                                                                                                                                                        SHA-256:BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
                                                                                                                                                                                                                                                        SHA-512:FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                        Joe Sandbox View:
                                                                                                                                                                                                                                                        • Filename: same.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                        • Filename: ebjtOH70jl.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                        • Filename: random(4).exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                        • Filename: EdYEXasNiR.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                        • Filename: 5EfYBe3nch.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                        • Filename: random.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                        • Filename: 8WFJ38EJo5.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                        • Filename: w22319us3M.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                        • Filename: 5uVReRlvME.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                        • Filename: DRWgoZo325.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\ProgramData\msvcp140.dll

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):450024
                                                                                                                                                                                                                                                        Entropy (8bit):6.673992339875127
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
                                                                                                                                                                                                                                                        MD5:5FF1FCA37C466D6723EC67BE93B51442
                                                                                                                                                                                                                                                        SHA1:34CC4E158092083B13D67D6D2BC9E57B798A303B
                                                                                                                                                                                                                                                        SHA-256:5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
                                                                                                                                                                                                                                                        SHA-512:4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\ProgramData\nss3.dll

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):2046288
                                                                                                                                                                                                                                                        Entropy (8bit):6.787733948558952
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
                                                                                                                                                                                                                                                        MD5:1CC453CDF74F31E4D913FF9C10ACDDE2
                                                                                                                                                                                                                                                        SHA1:6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
                                                                                                                                                                                                                                                        SHA-256:AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
                                                                                                                                                                                                                                                        SHA-512:DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\ProgramData\softokn3.dll

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):257872
                                                                                                                                                                                                                                                        Entropy (8bit):6.727482641240852
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
                                                                                                                                                                                                                                                        MD5:4E52D739C324DB8225BD9AB2695F262F
                                                                                                                                                                                                                                                        SHA1:71C3DA43DC5A0D2A1941E874A6D015A071783889
                                                                                                                                                                                                                                                        SHA-256:74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
                                                                                                                                                                                                                                                        SHA-512:2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\ProgramData\vcruntime140.dll

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):80880
                                                                                                                                                                                                                                                        Entropy (8bit):6.920480786566406
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
                                                                                                                                                                                                                                                        MD5:A37EE36B536409056A86F50E67777DD7
                                                                                                                                                                                                                                                        SHA1:1CAFA159292AA736FC595FC04E16325B27CD6750
                                                                                                                                                                                                                                                        SHA-256:8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
                                                                                                                                                                                                                                                        SHA-512:3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Bunny\Info.txt

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Windows\System32\dxdiag.exe
                                                                                                                                                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):85405
                                                                                                                                                                                                                                                        Entropy (8bit):5.206409311600344
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:768:/P9JWMB5MBB+Q6Uc8FgGVoXX7lV6EMR57X3i0hG6gHCXkNEr+aL/FkJOlKwY0:/7cKOV2uRoxHtOu0
                                                                                                                                                                                                                                                        MD5:3B8B45C78C4035678BEB4398B93802B0
                                                                                                                                                                                                                                                        SHA1:1BF171527F74E2BEB9A6EAD91ED7D999A19B9AEF
                                                                                                                                                                                                                                                        SHA-256:B99265EEB37BA2ED17ED9740E331CFCDEEFD8BF8C807FA845A8242A9B85D5575
                                                                                                                                                                                                                                                        SHA-512:546059755FADC56DF2BDC57E2C4D3AD1B7585DE0C36DA5AE2E26635285547F792B35F6386023ADAC7572EC502E0025CEB19A50EA6D9EF66E4CE9C652E84D36E8
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:------------------..System Information..------------------.. Time of this report: 1/7/2025, 07:19:28.. Machine name: 724471.. Machine Id: {92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A}.. Operating System: Windows 10 Pro 64-bit (10.0, Build 19045) (19041.vb_release.191206-1406).. Language: English (Regional Setting: English).. System Manufacturer: h96ocwcKYwRt824.. System Model: vRs XCOe.. BIOS: VMW201.00V.20829224.B64.2211211842 (type: UEFI).. Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz (4 CPUs), ~2.0GHz.. Memory: 8192MB RAM.. Available OS Memory: 8192MB RAM.. Page File: 1843MB used, 6347MB available.. Windows Dir: C:\Windows.. DirectX Version: DirectX 12.. DX Setup Parameters: Not found.. User DPI Setting: 96 DPI (100 percent).. System DPI Setting: 96 DPI (100 percent).. DWM DPI Scaling: Disable

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\D3DSCache\fe8d97be6d92aa78\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Windows\System32\dxdiag.exe
                                                                                                                                                                                                                                                        File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):65552
                                                                                                                                                                                                                                                        Entropy (8bit):0.012588069182000032
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:3:63qIllGlll/l/lXp9ZjrPBY06llcllXgvZP:63qIl0dPBY0O6/O
                                                                                                                                                                                                                                                        MD5:7A0F107CC175B4CA3EDB21F3953CB3E9
                                                                                                                                                                                                                                                        SHA1:7B64025EA33E429362475759AEB787CE8D3E101C
                                                                                                                                                                                                                                                        SHA-256:27F484DE82D7E1A41A5DC67D0AE827C8407C07FFDF1DEF1D61BB114E825F74E0
                                                                                                                                                                                                                                                        SHA-512:732FBF07C8C32F122E3DB2DEC40B727F9C1669F5103A741E56699C042530628755BDDC62E8F84B6321E2818F2080C17CF5FB0AE59C7701670491284C252C4BCB
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:.j..........................................f...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\D3DSCache\fe8d97be6d92aa78\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Windows\System32\dxdiag.exe
                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):4
                                                                                                                                                                                                                                                        Entropy (8bit):1.5
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:3:R:R
                                                                                                                                                                                                                                                        MD5:F49655F856ACB8884CC0ACE29216F511
                                                                                                                                                                                                                                                        SHA1:CB0F1F87EC0455EC349AAA950C600475AC7B7B6B
                                                                                                                                                                                                                                                        SHA-256:7852FCE59C67DDF1D6B8B997EAA1ADFAC004A9F3A91C37295DE9223674011FBA
                                                                                                                                                                                                                                                        SHA-512:599E93D25B174524495ED29653052B3590133096404873318F05FD68F4C9A5C9A3B30574551141FBB73D7329D6BE342699A17F3AE84554BAB784776DFDA2D5F8
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:EERF

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\D3DSCache\fe8d97be6d92aa78\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Windows\System32\dxdiag.exe
                                                                                                                                                                                                                                                        File Type:Matlab v4 mat-file (little endian) (, numeric, rows 0, columns 16, imaginary
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):65536
                                                                                                                                                                                                                                                        Entropy (8bit):0.020482262885854904
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:3:9llpl5d2DJqojBdl+Sli5lWyyHk15lRlTNlktt/llaia9sVQMm6En:c9q0Bn+SkSJkJNetb2Hrn
                                                                                                                                                                                                                                                        MD5:27C5B2CF8CC33DE010AE37B1B8B0E715
                                                                                                                                                                                                                                                        SHA1:F4B312BFCF51C533CA43AC8A5302450A906159AA
                                                                                                                                                                                                                                                        SHA-256:2EB0A2FD1624CFD6E21CF4121E8C44071EEAAA94FC1B0B9A39B23B571D58D40F
                                                                                                                                                                                                                                                        SHA-512:0ECF3D1E0FE3C336C5A12A01D0F960E605A3B1422ED1FE38C16BC959027890E91BC91C0DA70115ADDCFD4681112E8E20C6EAB68C2BF41F731CF97B05656B24DA
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:................>...(....x:no.&A.e.u~+..C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.d.x.d.i.a.g...e.x.e.................................(...p.DJ!.IL.....Zm.F............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\passwords.db

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):40960
                                                                                                                                                                                                                                                        Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                                        MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                                        SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                                        SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                                        SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\caf9f1bef3.exe.log

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exe
                                                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):226
                                                                                                                                                                                                                                                        Entropy (8bit):5.360398796477698
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
                                                                                                                                                                                                                                                        MD5:3A8957C6382192B71471BD14359D0B12
                                                                                                                                                                                                                                                        SHA1:71B96C965B65A051E7E7D10F61BEBD8CCBB88587
                                                                                                                                                                                                                                                        SHA-256:282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
                                                                                                                                                                                                                                                        SHA-512:76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4892bc80-3daf-4405-a510-45bb07ae7472.tmp

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):41554
                                                                                                                                                                                                                                                        Entropy (8bit):6.09205220911995
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kuzUXqgfbQlXUqNNJ8vQYqGwLWZkHUfG6kCvoZ:z/Ps+wsI7yn7TDqfyW0e6kaoZ
                                                                                                                                                                                                                                                        MD5:34339FFA3C6FFD919E055A937E79F96F
                                                                                                                                                                                                                                                        SHA1:DB2D66774997BE1D9B39B277C3A12E9CDF0BD82B
                                                                                                                                                                                                                                                        SHA-256:957B5F634A3B6F312F29D54ABF54BD6FA30B896CE7DDC1E91A2A5C3D90A6BB50
                                                                                                                                                                                                                                                        SHA-512:8F0FE09D8D253BF663863EDC77A1ACD9BE27C037FA520846397BD75CBCB2370AC56DB92D4AE9A3918431112D2252D15790563AB7E71FC876CA88501CC183F074
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\6d60a77f-97f6-4153-95cd-9088c34209ea.tmp

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):43133
                                                                                                                                                                                                                                                        Entropy (8bit):6.095694422634311
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kdkUXqgfbwPSbqBIAaVEZsPEOUQYqGwLWZkHUfG6kC+:z/Ps+wsI7ynVfq66qfyW0e6kaoZ
                                                                                                                                                                                                                                                        MD5:D30BC9DEEC54B3F30D9B6E0551CFA893
                                                                                                                                                                                                                                                        SHA1:780D3E53A59A2A1905B3BA29C83D2A374712AA26
                                                                                                                                                                                                                                                        SHA-256:6448422C401FA377DEDAF6D28A571736307F3F8F61846DA5836C99E958A48741
                                                                                                                                                                                                                                                        SHA-512:80EAF4A9FA26D29FD7886711AC5530E3FD45498AC42B22E7CAFFF264D899D51E038AC2730F82507BC57C149A2F7717E9CC3DAAA13963F08581C478F1D7BF3087
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-677D1BF6-FC4.pma

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):4194304
                                                                                                                                                                                                                                                        Entropy (8bit):0.047255239999353514
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:192:JCsHq0pqtmznOAHpY4JPi6VBK/7+HfgHX47IUMkYTwgh0MNBh+zRQcD/OvTDDn8H:bq0ctkLd4pJhhkVfKTDD08T2RGOD
                                                                                                                                                                                                                                                        MD5:A98B3F9517F8B7AA4A47B7E938EB321B
                                                                                                                                                                                                                                                        SHA1:432C1F3D3962A01BBC1623DB45E02DBD15CEDD06
                                                                                                                                                                                                                                                        SHA-256:676EEFAE421A5CFE1F5FCF8C7CB3AD1F1877B138D80B824BA9FF9138360C5BE7
                                                                                                                                                                                                                                                        SHA-512:9B92C1DA314BC36AF1069F41691D8A7F821824B355C6E684CCBC33E7766E35F429332D8FE3057805C3B9A534B51B8B62BC037B5BBE2A476A13A086F9463DB940
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:...@..@...@.....C.].....@...............xj..0Z..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?........".oxxacq20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............2..................8...w..U..G...W6.>.........."....."...24.."."GTJZX6ysgheZqBTPXcKXA+Ak8runmRph4F61XypBFRM="*.:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z........W@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................ .`2.......

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):280
                                                                                                                                                                                                                                                        Entropy (8bit):4.186405996455797
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:3:FiWWltlUkzpbazHSAS219jlV/TUqjNlWBVP/Sh/Jzv6cRBAVIGGgphVE7GC/htll:o1U6BaYIlWBVsJD6dpPhVeGC/
                                                                                                                                                                                                                                                        MD5:19287D1A749F585544F68BE58164B985
                                                                                                                                                                                                                                                        SHA1:C80EB89DE341127B62F92261A367903C2C624C57
                                                                                                                                                                                                                                                        SHA-256:AD8116F65282F87E2AA2FBFD002C2455DB865644CA6C5471975536ECB2B652A0
                                                                                                                                                                                                                                                        SHA-512:450BC3085162A0AA5DB09D9A2F5F8778744409C1B52699DD36C9354746036E2F321FD6ECB63F14E854C3423DAD6F1C7C65E7307C211ABFB48A845BAFFAC873F4
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:sdPC....................i...|.@..s..."GTJZX6ysgheZqBTPXcKXA+Ak8runmRph4F61XypBFRM="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................8963f191-f8e0-42ec-8449-d20a8242b3e6............

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\passwords.db

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):51200
                                                                                                                                                                                                                                                        Entropy (8bit):0.8746135976761988
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                                                                                                                                                                                                        MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                                                                                                                                                                                                        SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                                                                                                                                                                                                        SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                                                                                                                                                                                                        SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\webdata.db (copy)

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):40960
                                                                                                                                                                                                                                                        Entropy (8bit):0.8553638852307782
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                                                                                                        MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                                                                                                        SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                                                                                                        SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                                                                                                        SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):13
                                                                                                                                                                                                                                                        Entropy (8bit):2.7192945256669794
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:3:NYLFRQI:ap2I
                                                                                                                                                                                                                                                        MD5:BF16C04B916ACE92DB941EBB1AF3CB18
                                                                                                                                                                                                                                                        SHA1:FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
                                                                                                                                                                                                                                                        SHA-256:7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
                                                                                                                                                                                                                                                        SHA-512:F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:117.0.2045.47

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):41554
                                                                                                                                                                                                                                                        Entropy (8bit):6.09205220911995
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kuzUXqgfbQlXUqNNJ8vQYqGwLWZkHUfG6kCvoZ:z/Ps+wsI7yn7TDqfyW0e6kaoZ
                                                                                                                                                                                                                                                        MD5:34339FFA3C6FFD919E055A937E79F96F
                                                                                                                                                                                                                                                        SHA1:DB2D66774997BE1D9B39B277C3A12E9CDF0BD82B
                                                                                                                                                                                                                                                        SHA-256:957B5F634A3B6F312F29D54ABF54BD6FA30B896CE7DDC1E91A2A5C3D90A6BB50
                                                                                                                                                                                                                                                        SHA-512:8F0FE09D8D253BF663863EDC77A1ACD9BE27C037FA520846397BD75CBCB2370AC56DB92D4AE9A3918431112D2252D15790563AB7E71FC876CA88501CC183F074
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3bc5c.TMP (copy)

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):41554
                                                                                                                                                                                                                                                        Entropy (8bit):6.09205220911995
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kuzUXqgfbQlXUqNNJ8vQYqGwLWZkHUfG6kCvoZ:z/Ps+wsI7yn7TDqfyW0e6kaoZ
                                                                                                                                                                                                                                                        MD5:34339FFA3C6FFD919E055A937E79F96F
                                                                                                                                                                                                                                                        SHA1:DB2D66774997BE1D9B39B277C3A12E9CDF0BD82B
                                                                                                                                                                                                                                                        SHA-256:957B5F634A3B6F312F29D54ABF54BD6FA30B896CE7DDC1E91A2A5C3D90A6BB50
                                                                                                                                                                                                                                                        SHA-512:8F0FE09D8D253BF663863EDC77A1ACD9BE27C037FA520846397BD75CBCB2370AC56DB92D4AE9A3918431112D2252D15790563AB7E71FC876CA88501CC183F074
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3bc6b.TMP (copy)

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):41554
                                                                                                                                                                                                                                                        Entropy (8bit):6.09205220911995
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kuzUXqgfbQlXUqNNJ8vQYqGwLWZkHUfG6kCvoZ:z/Ps+wsI7yn7TDqfyW0e6kaoZ
                                                                                                                                                                                                                                                        MD5:34339FFA3C6FFD919E055A937E79F96F
                                                                                                                                                                                                                                                        SHA1:DB2D66774997BE1D9B39B277C3A12E9CDF0BD82B
                                                                                                                                                                                                                                                        SHA-256:957B5F634A3B6F312F29D54ABF54BD6FA30B896CE7DDC1E91A2A5C3D90A6BB50
                                                                                                                                                                                                                                                        SHA-512:8F0FE09D8D253BF663863EDC77A1ACD9BE27C037FA520846397BD75CBCB2370AC56DB92D4AE9A3918431112D2252D15790563AB7E71FC876CA88501CC183F074
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):85
                                                                                                                                                                                                                                                        Entropy (8bit):4.3488360343066725
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:3:YQ3JYq9xSs0dMEJAELJ25AmIpozQw:YQ3Kq9X0dMgAEiLI2
                                                                                                                                                                                                                                                        MD5:265DB1C9337422F9AF69EF2B4E1C7205
                                                                                                                                                                                                                                                        SHA1:3E38976BB5CF035C75C9BC185F72A80E70F41C2E
                                                                                                                                                                                                                                                        SHA-256:7CA5A3CCC077698CA62AC8157676814B3D8E93586364D0318987E37B4F8590BC
                                                                                                                                                                                                                                                        SHA-512:3CC9B76D8D4B6EDB4C41677BE3483AC37785F3BBFEA4489F3855433EBF84EA25FC48EFEE9B74CAB268DC9CB7FB4789A81C94E75C7BF723721DE28AEF53D8B529
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":2}

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d4918a89-749f-44e2-a50e-d3ae55f41d64.tmp

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                        Category:modified
                                                                                                                                                                                                                                                        Size (bytes):43133
                                                                                                                                                                                                                                                        Entropy (8bit):6.095694422634311
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kdkUXqgfbwPSbqBIAaVEZsPEOUQYqGwLWZkHUfG6kC+:z/Ps+wsI7ynVfq66qfyW0e6kaoZ
                                                                                                                                                                                                                                                        MD5:D30BC9DEEC54B3F30D9B6E0551CFA893
                                                                                                                                                                                                                                                        SHA1:780D3E53A59A2A1905B3BA29C83D2A374712AA26
                                                                                                                                                                                                                                                        SHA-256:6448422C401FA377DEDAF6D28A571736307F3F8F61846DA5836C99E958A48741
                                                                                                                                                                                                                                                        SHA-512:80EAF4A9FA26D29FD7886711AC5530E3FD45498AC42B22E7CAFFF264D899D51E038AC2730F82507BC57C149A2F7717E9CC3DAAA13963F08581C478F1D7BF3087
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\freebl3[1].dll

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):685392
                                                                                                                                                                                                                                                        Entropy (8bit):6.872871740790978
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
                                                                                                                                                                                                                                                        MD5:550686C0EE48C386DFCB40199BD076AC
                                                                                                                                                                                                                                                        SHA1:EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
                                                                                                                                                                                                                                                        SHA-256:EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
                                                                                                                                                                                                                                                        SHA-512:0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\fuckingdllENCR[1].dll

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe
                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):97296
                                                                                                                                                                                                                                                        Entropy (8bit):7.9982317718947025
                                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                                        SSDEEP:1536:A1FazaNKjs9ezO6kGnCRFVjltPjM9Ew1MhiIeJfZCQdOlnq32YTCUZiyAS3tUX9F:k4zaMjVUGCRzbgqw1MoIeJyQ4nyqX9F
                                                                                                                                                                                                                                                        MD5:E6743949BBF24B39B25399CD7C5D3A2E
                                                                                                                                                                                                                                                        SHA1:DBE84C91A9B0ACCD2C1C16D49B48FAEAEC830239
                                                                                                                                                                                                                                                        SHA-256:A3B82FC46635A467CC8375D40DDBDDD71CAE3B7659D2BB5C3C4370930AE9468C
                                                                                                                                                                                                                                                        SHA-512:3D50396CDF33F5C6522D4C485D96425C0DDB341DB9BD66C43EAE6D8617B26A4D9B4B9A5AEE0457A4F1EC6FAC3CB8208C562A479DCAE024A50143CBFA4E1F15F6
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:XM .4Ih..]...t.&.s...v.0{.v.vs'...:.l.h...e.....R....1...r.R+Fk*....~.s.....Q.....r.T.b.....~c..[........;...j.@.0.%.....x...v.w.....<ru....Yre;.b6...HQ-...8.B..Q.a...R.:.h&r.......=.;r.k..T.@....l..;#..3!.O..x.}........y'<.GfQ.K.#.L5v..].......d....N{e..@................A\..<.t.u.X.O.n..Z.. .Xb.O<.*Z...h~.(.W.f.z.V.4..L...%5.0...H..`s...y.B......(IL5s:aS}X.......M9.J.o....).'..M;n6]...W..n....)...L...._..e.....>....[....RA.........'...6.N..g6....IY.%h.. 3r....^..\.b~y./....h.2......ZLk....u}..V..<.fbD.<!.._2.zo..IE...P..*O...u......P.......w#.6N..&l.R}GI...LY...N.yz..j..Hy.'..._.5..Pd9.y..+....6.q*...).G.c...L#....5\.M....5U])....U(..~H.m....Y....G1.r.4.B..h........P..]i...M%.............)q......]....~|..j...b..K!..N.7R.}T.2bsq..1...L^..!.|q.D'...s.Ln...D@..bn%0=b.Q1.....+l...QXO|.......NC.d......{.0....8F.....<.W.y..{o..j.3.....n..4.....eS]. K...o.B.H~.sh.1....m8....6{.ls..R..q..~....w._;....X*.#..U....6n.ODbT.+Zc....q....S.$-S`YT....

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\mozglue[1].dll

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):608080
                                                                                                                                                                                                                                                        Entropy (8bit):6.833616094889818
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
                                                                                                                                                                                                                                                        MD5:C8FD9BE83BC728CC04BEFFAFC2907FE9
                                                                                                                                                                                                                                                        SHA1:95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
                                                                                                                                                                                                                                                        SHA-256:BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
                                                                                                                                                                                                                                                        SHA-512:FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\msvcp140[1].dll

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):450024
                                                                                                                                                                                                                                                        Entropy (8bit):6.673992339875127
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
                                                                                                                                                                                                                                                        MD5:5FF1FCA37C466D6723EC67BE93B51442
                                                                                                                                                                                                                                                        SHA1:34CC4E158092083B13D67D6D2BC9E57B798A303B
                                                                                                                                                                                                                                                        SHA-256:5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
                                                                                                                                                                                                                                                        SHA-512:4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\nss3[1].dll

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):2046288
                                                                                                                                                                                                                                                        Entropy (8bit):6.787733948558952
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
                                                                                                                                                                                                                                                        MD5:1CC453CDF74F31E4D913FF9C10ACDDE2
                                                                                                                                                                                                                                                        SHA1:6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
                                                                                                                                                                                                                                                        SHA-256:AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
                                                                                                                                                                                                                                                        SHA-512:DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[1].exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):3104256
                                                                                                                                                                                                                                                        Entropy (8bit):6.625022195702856
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:49152:fWBcAgnnqVX9myu4fWiQbBpZp1xnZ5h6KOXebx6MnF1g:fWCnnqVX9myNOiQb/96RObxlnFe
                                                                                                                                                                                                                                                        MD5:612B785A52C7C281DD891D4835E0E4CE
                                                                                                                                                                                                                                                        SHA1:689A488E8E86D7F820732871FB795D193100C8EC
                                                                                                                                                                                                                                                        SHA-256:DB2E536B6E14A6E936ACBEEC7478624756F82C5A4EAEC9353B4EE7628153970F
                                                                                                                                                                                                                                                        SHA-512:384E22D7D20FB61D1F19672C1A6982532BA54EEFE6A07E97E4CBFAA89E24D2C2FAB7659F000916988159F1F661724205FFC0FC44749B9EFA7ED375B93645698F
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....vg.................H...........p/...........@.........................../.....T\0...@.................................Y...m....p.............................................................................................................. . .`.......`..................@....rsrc........p.......p..............@....idata .............t..............@...ikmnjisi..).......)..v..............@...nmpoliea.....`/......8/.............@....taggant.0...p/.."...</.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[2].exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):1963520
                                                                                                                                                                                                                                                        Entropy (8bit):7.941995285869976
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:49152:8AoagQKVb2LRNKNxePyA0PzhpaVQ2fFw7m8:oaOVq1NKviRX/fFw7Z
                                                                                                                                                                                                                                                        MD5:B87ABAE5DCF781D2DD96D6C8FBBDE6FF
                                                                                                                                                                                                                                                        SHA1:C6590E8C9C86ADC3DF550C72EA04433CEF32398C
                                                                                                                                                                                                                                                        SHA-256:87599BA82297583457EE7FC605D80A3C02F60603CD4BF16428556A834A6DD8BA
                                                                                                                                                                                                                                                        SHA-512:7A2ED19AD0B13C98D5BE1EC69F7718C01AF7FF675C229A11A7726636FAC912E1F7C38098D4895906434DBF73914CDE793C1DA9D1BFE8B9AE55F45979BD0EDF5C
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i...........nG@.....ZR.....ZC.....ZU.................Z\.....ZB.....ZG....Rich...................PE..L....,.e.....................>...................@.................................J.......................................[.A.o.....@.....................................................|Q...................................................... . ..@......N..................@....rsrc.........@..p...^..............@....idata ......A.....................@... .0*...A.....................@...ltmerovd......k.....................@...uydrgwnj............................@....taggant.0......"..................@...........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[3].exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):4486656
                                                                                                                                                                                                                                                        Entropy (8bit):7.984911176545157
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:98304:o/eaCc5VyK7PPmzg4+c19Z/4jOA7EPR6gYXVFqcLas:8NBd2P/qePR6gcocLa
                                                                                                                                                                                                                                                        MD5:F8AF2AA72956A4C4DE223ABA02173783
                                                                                                                                                                                                                                                        SHA1:DDD07603C84296B43597B489B13465936489F1CD
                                                                                                                                                                                                                                                        SHA-256:14D7083C6C1E5525FBA1CB9DBF1F583A0E57776AACC59D736BFE9D80AC615AFC
                                                                                                                                                                                                                                                        SHA-512:D2427DE976D1690437391E285E6CB94D8CB6C746EFD476D6C56F40FBCD9D5FA46BDE29E4DCA7C4E57938C5CB5ED15DF1769BEF7359CC78676FF2ED4B965C1604
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Yara Hits:
                                                                                                                                                                                                                                                        • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[3].exe, Author: Joe Security
                                                                                                                                                                                                                                                        • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[3].exe, Author: Joe Security
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....a{g...............(..J...h..2............J...@..........................0........D...@... ............................._.f.s.....e...............h.....4..................................................................................... . ..e.......(.................@....rsrc.........e.......(.............@....idata ......f.......(.............@... .09...f.......(.............@...xpqdeyne.....@........(.............@...nykjqzsf............ND.............@....taggant.0......."...TD.............@...........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[4].exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):439296
                                                                                                                                                                                                                                                        Entropy (8bit):6.489951590243045
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:12288:24RGSlxPlNjb1kaVKfpy4FjMSkhCzL7ARDWb:5lNbKTZMzO4RDY
                                                                                                                                                                                                                                                        MD5:CD0C9B8F92C8BE5F0044145E99E98D43
                                                                                                                                                                                                                                                        SHA1:698637B2A7FD4740A6B96A736B82FFFB0CE67819
                                                                                                                                                                                                                                                        SHA-256:68F60B3ECF60546520E15E442401384703B5436F6F7224BCC6F92B4CA24BABA6
                                                                                                                                                                                                                                                        SHA-512:033B7FFF79F9AF35E92781AAADA06A55619EDDCF7D4BC40FD7EE027627E6AE770F96F2A11148392E64EF2495F30A90DD2486115EF1A7FB1408678FD14E17E5C2
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Yara Hits:
                                                                                                                                                                                                                                                        • Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\random[4].exe, Author: Joe Security
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 55%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........BS..,...,...,.../...,...).#.,..(...,../...,..)...,.......,...(...,...-...,...-.j.,.U.%...,.U.....,.U.....,.Rich..,.........PE..L....Uhg............................'.............@..........................0............@..................................E...................................E......8...............................@...............<............................text...j........................... ..`.rdata...H.......J..................@..@.data....m...`...,...@..............@....rsrc................l..............@..@.reloc...E.......F...n..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\softokn3[1].dll

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):257872
                                                                                                                                                                                                                                                        Entropy (8bit):6.727482641240852
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
                                                                                                                                                                                                                                                        MD5:4E52D739C324DB8225BD9AB2695F262F
                                                                                                                                                                                                                                                        SHA1:71C3DA43DC5A0D2A1941E874A6D015A071783889
                                                                                                                                                                                                                                                        SHA-256:74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
                                                                                                                                                                                                                                                        SHA-512:2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GIBVL2EB\vcruntime140[1].dll

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):80880
                                                                                                                                                                                                                                                        Entropy (8bit):6.920480786566406
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
                                                                                                                                                                                                                                                        MD5:A37EE36B536409056A86F50E67777DD7
                                                                                                                                                                                                                                                        SHA1:1CAFA159292AA736FC595FC04E16325B27CD6750
                                                                                                                                                                                                                                                        SHA-256:8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
                                                                                                                                                                                                                                                        SHA-512:3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\download[1].htm

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe
                                                                                                                                                                                                                                                        File Type:very short file (no magic)
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):1
                                                                                                                                                                                                                                                        Entropy (8bit):0.0
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:3:V:V
                                                                                                                                                                                                                                                        MD5:CFCD208495D565EF66E7DFF9F98764DA
                                                                                                                                                                                                                                                        SHA1:B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
                                                                                                                                                                                                                                                        SHA-256:5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
                                                                                                                                                                                                                                                        SHA-512:31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:0

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[1].exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):349696
                                                                                                                                                                                                                                                        Entropy (8bit):7.968250820517949
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:6144:AT1Bgj04zLS/70E7IodJ6vsVzsooEAPmIV49g2/GzrtXAlGSExj76f:Gb45zA7Fv6vsVOzm9t/Gzr9AsdP6f
                                                                                                                                                                                                                                                        MD5:6446A00EB59754E15749AF229B0D5217
                                                                                                                                                                                                                                                        SHA1:69C0311F0B121EB378E90A1DD88925C424C1A07B
                                                                                                                                                                                                                                                        SHA-256:558FE8C705BBD035F886CC02ACEE3FDFA50398E74795F62D182E01225D58E2E2
                                                                                                                                                                                                                                                        SHA-512:63FFDDB80FAA7013DC4C665E1614EE7175D313868636E2D6BC9B8E1FA941134FF425F6F02C64A5509EB97A9BE8BB87A2A9859CD57E72D10B7BBF13887CF0BA58
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 50%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...AL................0..B...........a... ........@.. ....................................`.................................Pa..K....................................a............................................... ............... ..H............text....A... ...B.................. ..`.rsrc................F..............@..@.reloc...............L..............@..B.BSS.................N..............@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[2].exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):969728
                                                                                                                                                                                                                                                        Entropy (8bit):6.7013702693872865
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:24576:wqDEvCTbMWu7rQYlBQcBiT6rprG8am9Weel:wTvC/MTQYxsWR7am9ne
                                                                                                                                                                                                                                                        MD5:A5F4B776FBC130947C7EA91252E30747
                                                                                                                                                                                                                                                        SHA1:B8EE9FDE8E876836E0AE6D1C592950FF743A411E
                                                                                                                                                                                                                                                        SHA-256:0B66B1F82F34FB2C4B7DC1B9EE3A7615D7FF522E9EB57951F0E20E1D944699F0
                                                                                                                                                                                                                                                        SHA-512:0D6A5E150D614F1586BFB1CA8ED1AADD7B7CDF26F1F62436F7535271E22D185D99A35272100CE11F01361DB4A8352A979B265A7BB8962EFCEB411F670C094D8E
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....}g..........".................w.............@..........................0......u.....@...@.......@.....................d...|....@...a.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....a...@...b..................@..@.reloc...u.......v...V..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[3].exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):369152
                                                                                                                                                                                                                                                        Entropy (8bit):7.933865064723301
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:6144:C9Y1yj7QbH9cmXVllnABXgebDPBG414r3drK+4rTp3kzVIBhVpwqskhmyAx5a1K7:a9j7QbH9zllABzDpZ14Bj4rTxMVIVpPu
                                                                                                                                                                                                                                                        MD5:7AE95FCD206995D8FDA2FF624463FE49
                                                                                                                                                                                                                                                        SHA1:18942C4E99F09F2838EB3DA8F5ECCFCD1551645B
                                                                                                                                                                                                                                                        SHA-256:CB8DDA761937E236727EA5D37C8572ED239C0C511F0C81B2C5A6B54E3C8D478F
                                                                                                                                                                                                                                                        SHA-512:CA2C4296EFB88B0FC346E3AC3D22939278F99EA39D42E2F90CE32A25F3D2F0E1A6933B84999B84A7233EAF45C6B6C58A1426783DC98B8F960DBD7E846197FB6D
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 45%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....C,...............0.................. ........@.. ....................... ............`.................................p...K.......B..........................."................................................ ............... ..H............text....... ...................... ..`.rsrc...B...........................@..@.reloc..............................@..B.bss................................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[4].exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):1038693
                                                                                                                                                                                                                                                        Entropy (8bit):7.892980238860217
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:24576:YLA96z4S/zCtTFL/qcF8UReLbpPEwpA0jg8Zg:mA6/EFO+8selrpm
                                                                                                                                                                                                                                                        MD5:89841D2045725C18C80011B9CE901B4E
                                                                                                                                                                                                                                                        SHA1:CB27F6A88454817FB675D1288C0AC455BE1AC42B
                                                                                                                                                                                                                                                        SHA-256:E064EEAB25A47FD1D9B0BF40C8A82254E5F3A5EBB332129F6B91F7E7B6D60A91
                                                                                                                                                                                                                                                        SHA-512:255AA3D8F3AEE82D92B0669D0438A4612FEB48295032C1D97E5FE7A251EDC857C726A4A98ADDF9A69A40192D39DDD335B4F9EB1C6094CF63F456E3E8C512F10C
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 11%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ`.....................@...................................`...........!..L.!Require Windows..$PE..d......L..........#..........8......d..........@.............................0......7................................................................p.......P..........`Z...........................................................................................text............................... ..`.rdata..lR.......T..................@..@.data..../... ......................@....pdata.......P......................@..@.rsrc........p.......*..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[5].exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):9578331
                                                                                                                                                                                                                                                        Entropy (8bit):7.579199063799339
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:196608:UxB14xuTMS+BPC2cZ07LqyUl7m6/ZTYtSx0USapM7KxBx:YL4QTz+YZ0/qXjpYteX
                                                                                                                                                                                                                                                        MD5:8EA30ACC005292F38B5B3886F244B2A9
                                                                                                                                                                                                                                                        SHA1:FEAAEEF18B6D2A5A2B974B5A32D970E8D9356321
                                                                                                                                                                                                                                                        SHA-256:77D5C3A637603FEF747234B246F206CB3AC8200BC018A4D78D437FE80B0D071F
                                                                                                                                                                                                                                                        SHA-512:77910C47AC6C57982DB81DA036A0C78CA43792EDB7F91D2E07903AB4A833C528F9C13100745D801C06B5649672E00BFDA5475BC25C17FB2D7EEAC0DE9981697F
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Yara Hits:
                                                                                                                                                                                                                                                        • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\random[5].exe, Author: Joe Security
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 22%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[F.$.'`w.'`w.'`w..w.'`w..w.'`w.ydv.'`w..w.'`w..w.'`w..w_'`w.P.w.'`w.'aw.&`w.P.w.'`w..w2'`w..w.'`w.'.w.'`w..w.'`wRich.'`w................PE..L...P.,a.............................6............@.......................................@.................................\F..........t....................`...j..@...8...............................@....................B.......................text............................... ..`.rdata..T...........................@..@.data...XI...p...$...L..............@....rsrc...t............p..............@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ONMZACOW\add[1].htm

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe
                                                                                                                                                                                                                                                        File Type:very short file (no magic)
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):1
                                                                                                                                                                                                                                                        Entropy (8bit):0.0
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:3:V:V
                                                                                                                                                                                                                                                        MD5:CFCD208495D565EF66E7DFF9F98764DA
                                                                                                                                                                                                                                                        SHA1:B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
                                                                                                                                                                                                                                                        SHA-256:5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
                                                                                                                                                                                                                                                        SHA-512:31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:0

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ONMZACOW\download[1].htm

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe
                                                                                                                                                                                                                                                        File Type:very short file (no magic)
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):1
                                                                                                                                                                                                                                                        Entropy (8bit):0.0
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:3:V:V
                                                                                                                                                                                                                                                        MD5:CFCD208495D565EF66E7DFF9F98764DA
                                                                                                                                                                                                                                                        SHA1:B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
                                                                                                                                                                                                                                                        SHA-256:5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
                                                                                                                                                                                                                                                        SHA-512:31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:0

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ONMZACOW\key[1].htm

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe
                                                                                                                                                                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):21
                                                                                                                                                                                                                                                        Entropy (8bit):3.880179922675737
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:3:gFsR0GOWW:gyRhI
                                                                                                                                                                                                                                                        MD5:408E94319D97609B8E768415873D5A14
                                                                                                                                                                                                                                                        SHA1:E1F56DE347505607893A0A1442B6F3659BEF79C4
                                                                                                                                                                                                                                                        SHA-256:E29A4FD2CB1F367A743EA7CFD356DBD19AEB271523BBAE49D4F53257C3B0A78D
                                                                                                                                                                                                                                                        SHA-512:994FA19673C6ADC2CC5EF31C6A5C323406BB351551219EE0EEDA4663EC32DAF2A1D14702472B5CF7B476809B088C85C5BE684916B73046DA0DF72236BC6F5608
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:9tKiK3bsYm4fMuK47Pk3s

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ONMZACOW\random[1].exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):1883136
                                                                                                                                                                                                                                                        Entropy (8bit):7.94769287989194
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:49152:+ZUqbdBAiUW1jWtLeMlQKuEqmHIs0jDzgkzwc+lvQKCN:+ZUqJ8MWtqMlQKubmH30jDz70c+lvF
                                                                                                                                                                                                                                                        MD5:37E85A34D4EC7C387A79E20CE262F2CF
                                                                                                                                                                                                                                                        SHA1:701896F9EDFC48C14CD49A4E521B7516F35A93AD
                                                                                                                                                                                                                                                        SHA-256:4EA639F777465509D3246C1294E7AEE3AE5FCCEEFDA0A0E6492CD40C9200A669
                                                                                                                                                                                                                                                        SHA-512:E8254EF680EB4DB2B3D3412DDD47AE8C700C957C5C0E703FD8A2F10A129978E856E5961CAEA2D9641AF50BFB37E37C506BBDE4B0228BE0C9EAE037C22CB73577
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....vg.................H...........PJ...........@...........................J......=....@.................................Y...m....p.............................................................................................................. . .`..........................@....rsrc........p......................@....idata ............................@... ..*.........................@...gtgwsuzl.....@0.....................@...hkqimwut.....@J.....................@....taggant.0...PJ.."..................@...................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ONMZACOW\random[2].exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):2761216
                                                                                                                                                                                                                                                        Entropy (8bit):6.497249856533143
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:49152:qgNclweCw7A75XpD+/ejYAIrMN1FXvJ8D3YwfaXelz0Z:GlweCwc1XpD+2DhvafaXmz0
                                                                                                                                                                                                                                                        MD5:CB31FF98156630BF835768E1C1B47EE1
                                                                                                                                                                                                                                                        SHA1:835B71E4F8F8BE2EE1AF49543CCC80D9DEFE8F78
                                                                                                                                                                                                                                                        SHA-256:EAE09F56D1E647F890D3AE6653B644D41F6A136308C975C044C96F57300DA601
                                                                                                                                                                                                                                                        SHA-512:FFB71102EBFD51A7A22B812A32E645620EA64426EAD190210E99F176DAE50F89320FC142D28EED7F510C28CD48ED41ECCF858D848EED1B498A53D3EAEE83CC79
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............*.. ...`....@.. ........................*.......*...`.................................U...i....`..D........................................................................................................... . .@... ....... ..............@....rsrc...D....`.......2..............@....idata . ...........6..............@...dqmrytmu..).......)..8..............@...pxqnvvkn. ....*.......).............@....taggant.@....*.."....*.............@...................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ONMZACOW\random[3].exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):67072
                                                                                                                                                                                                                                                        Entropy (8bit):7.123316522551807
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:1536:CeNyuZ4UbqcHd7XcdyazUUGyvV3xbibHPgosH:McbqcHd7McKjUIou
                                                                                                                                                                                                                                                        MD5:9D55F610F83116A12DD6DB6B6261AAF2
                                                                                                                                                                                                                                                        SHA1:2502C6C4565FE231B849D69F08485120698FB01C
                                                                                                                                                                                                                                                        SHA-256:3995C65E4F9C94B2E583A92293D5FC8518363BB1B08C62E2D7C613F1B1AC1CBE
                                                                                                                                                                                                                                                        SHA-512:E6FD48CF8C4862FEFA66F0E4C71C723FAF508D694760CC48EF49921D822E959398C997D31956FAA2C8B9F21C8A8DF1223AC6DA9A5A63D694C7E0F034284C3BC4
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 52%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....C,...............0.................. ........@.. ...............................p....`.................................p...K.......B..........................."................................................ ............... ..H............text....... ...................... ..`.rsrc...B...........................@..@.reloc..............................@..B.bss.....v.......v..................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\download[1].htm

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe
                                                                                                                                                                                                                                                        File Type:very short file (no magic)
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):1
                                                                                                                                                                                                                                                        Entropy (8bit):0.0
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:3:V:V
                                                                                                                                                                                                                                                        MD5:CFCD208495D565EF66E7DFF9F98764DA
                                                                                                                                                                                                                                                        SHA1:B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
                                                                                                                                                                                                                                                        SHA-256:5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
                                                                                                                                                                                                                                                        SHA-512:31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:0

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[1].exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):13955025
                                                                                                                                                                                                                                                        Entropy (8bit):7.99670036631878
                                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                                        SSDEEP:393216:QY9YiZ+XMCHWUjccuICvR/P0vKfXmsg8YiZdo:19YiZ+XMb8JE/svKOudo
                                                                                                                                                                                                                                                        MD5:CB538563778A18D571E87AD75705668E
                                                                                                                                                                                                                                                        SHA1:7B38FB2F64AE19BAA5D97C6B0EEB6755A25AE427
                                                                                                                                                                                                                                                        SHA-256:E704FBF6BB0455563B3B37D1C67EAEAE8F9C74F6309C67396D4BEA566ABAD90F
                                                                                                                                                                                                                                                        SHA-512:5D883732D96B0C66E939F1823A6A062CC83A0D6A704386EF19A741B84323DA6A4DDC67D977AB804399A7D56BFA31DCD8348C008E82A0F19FFB62BAC37B0D08E7
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 48%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n=..*\.Z*\.Z*\.Za$.[-\.Za$.[.\.Za$.[ \.Z:..Z)\.Z:..[#\.Z:..[;\.Z:..[.\.Za$.[!\.Z*\.Z.\.Zb..[3\.Zb..[+\.ZRich*\.Z........PE..d...l.Ng.........."....).....~.................@....................................:.....`.................................................\...x....p.......@..P"..............d...................................@...@............................................text............................... ..`.rdata..P*.......,..................@..@.data....S..........................@....pdata..P"...@...$..................@..@.rsrc........p......................@..@.reloc..d...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[2].exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):1864192
                                                                                                                                                                                                                                                        Entropy (8bit):7.945598151255693
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:49152:q5eCT3PGWaVABisbebqgoy6zNZ/N5SU9a:q5eCyVKisbrzy6zNMAa
                                                                                                                                                                                                                                                        MD5:8E7317BD5F12DA95C46CA94572B2C331
                                                                                                                                                                                                                                                        SHA1:F4D5D81D5455D2EF430530CA46266CB263C0A4C3
                                                                                                                                                                                                                                                        SHA-256:AF3387F8CF8C8581429C089B8B0CF1C5DADB32F2034EC21DD5A5149EAF8BF4E5
                                                                                                                                                                                                                                                        SHA-512:4A3D839A55AC2CA1AAA56EE4A7F5762BAEE5CDA44F9CBECD93B79188A9BAD1EFF7D3F48ECE83071CF3FA1BA3BC26B1D9E6B7F9DA3317BE4E5291B50617A51281
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L..."&{g.....................*.......pk...........@...........................k...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... ..+...$......|..............@...scpusmou......P......~..............@...wkvcxnam.....`k......L..............@....taggant.0...pk.."...P..............@...................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[3].exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):1771008
                                                                                                                                                                                                                                                        Entropy (8bit):6.829704744143836
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:24576:CS3RWpdupsY0HhzA6AydDu9H73NvHgTxRnqY33u4citY1HtFPMRWpYp:3idupsYohzA6AydDu9leXu4ciGHi
                                                                                                                                                                                                                                                        MD5:1C0FDE14F7A46816A2E8A747A90E1584
                                                                                                                                                                                                                                                        SHA1:76EDA2D23786BE801521479B6C83D97C16B27879
                                                                                                                                                                                                                                                        SHA-256:D2638065D9C0CF218EFA5E05DC67E282110E854DE56D4A124D3DF57068B2E3E3
                                                                                                                                                                                                                                                        SHA-512:AE60B7D606BB2B8D1AF89CD828386AD33EC85FD75ADB7810EE988445880412E5CD71584327167E839B1F6C6DB5F876F9F88D4BAEB862ABFCE085FA43D70CEC3F
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 37%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........*.7.K.d.K.d.K.dT9.e.K.dT9.e.K.dT9.e3K.dT9.e.K.dT9.e.K.d.K.d.I.d.>.e.K.d.>.e.K.d.>.e.K.d.>.e.K.d.>9d.K.d.KQd.K.d.>.e.K.dRich.K.d........PE..L......`.....................v......T.............@..........................`.......L......................................|+..@....................`.. J..........@...8...........................x...@............................................text............................... ..`.rdata..............................@..@.data...tM...`... ...B..............@....rsrc................b..............@..@........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[4].exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):500224
                                                                                                                                                                                                                                                        Entropy (8bit):6.9993751003868185
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:12288:R3fscf4y94gU6rfENQ9zAsfwlpbjLkV/qXzyi1MR:R30g4y94mr8izAsybPkV6
                                                                                                                                                                                                                                                        MD5:9BF8B21D5ABECC43F525F3A2C8C1E20B
                                                                                                                                                                                                                                                        SHA1:5779681435EE1BCB22C610656E00A06FBF2D353F
                                                                                                                                                                                                                                                        SHA-256:22000D5648CBAADD7B84456DD52F9F57ECB972AC39CB47AAD330E4DE6390B7DA
                                                                                                                                                                                                                                                        SHA-512:5E7AFDC93D2A66A4C8FC671AB3922D18163EE2690EE5828D5C8BA9801E48DF9D1DC32B3BF929BCA57F6A79294DB790FEF8957E2BB43CE5D91E3D678AF3152E74
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 39%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....{g..............0.............N.... ........@.. ....................................@.....................................W.......6............................................................................ ............... ..H............text...T.... ...................... ..`.rsrc...6...........................@..@.reloc..............................@..B................0.......H...........$.......\...................................................gZ$.....................t.................................................h.`LKA.DBEMBSG.QSFFE@.RO.B?F.KF.pea.GEPO.............h.....Y...Y...Y._.Z$..Y._.Z...Y._.Z%..Y._.Z...Y...Y...Y...Y...Y.\.Z/..Y.\.Z ..Y.\.Z%..Y...Y...Y^\.Z...Y^\.Z...YbKQL...Y........do..h.....9M....................$.......;.......t...........................................t.........................$...8.......d...................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\random[5].exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):366592
                                                                                                                                                                                                                                                        Entropy (8bit):7.932557778611599
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:6144:p9XhFJ2ZJUzLhX+oRdfvl/HxkU++Ql36XMMs7cVRK85xm9tGRDytvl6D5wykAVY:PrJsJUzLhJ3l/RkU+b3lAVDgTGROtt6s
                                                                                                                                                                                                                                                        MD5:CCB04B4CABC97CF7EE795375C67CADEF
                                                                                                                                                                                                                                                        SHA1:F00D48BB8B35385C9FA3F642A87E354CE81A975E
                                                                                                                                                                                                                                                        SHA-256:2F96884BCF44E4E75181C8E0EBB9C8FB3AE58479E91E995EBCED6490291ED19D
                                                                                                                                                                                                                                                        SHA-512:8F79DCBAB8940EF6A08607CC3CECA35DBEDFCFC6492E07705A4878DFD3433186447E4E1F1BCEBCE57C6B36F5FDD97F99066232B4C4F8DE986DBDDFF2F725BD90
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 83%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....C,...............0.................. ........@.. ....................... .......G....`.................................p...K.......B..........................."................................................ ............... ..H............text....... ...................... ..`.rsrc...B...........................@..@.reloc..............................@..B.bss................................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):13955025
                                                                                                                                                                                                                                                        Entropy (8bit):7.99670036631878
                                                                                                                                                                                                                                                        Encrypted:true
                                                                                                                                                                                                                                                        SSDEEP:393216:QY9YiZ+XMCHWUjccuICvR/P0vKfXmsg8YiZdo:19YiZ+XMb8JE/svKOudo
                                                                                                                                                                                                                                                        MD5:CB538563778A18D571E87AD75705668E
                                                                                                                                                                                                                                                        SHA1:7B38FB2F64AE19BAA5D97C6B0EEB6755A25AE427
                                                                                                                                                                                                                                                        SHA-256:E704FBF6BB0455563B3B37D1C67EAEAE8F9C74F6309C67396D4BEA566ABAD90F
                                                                                                                                                                                                                                                        SHA-512:5D883732D96B0C66E939F1823A6A062CC83A0D6A704386EF19A741B84323DA6A4DDC67D977AB804399A7D56BFA31DCD8348C008E82A0F19FFB62BAC37B0D08E7
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 48%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n=..*\.Z*\.Z*\.Za$.[-\.Za$.[.\.Za$.[ \.Z:..Z)\.Z:..[#\.Z:..[;\.Z:..[.\.Za$.[!\.Z*\.Z.\.Zb..[3\.Zb..[+\.ZRich*\.Z........PE..d...l.Ng.........."....).....~.................@....................................:.....`.................................................\...x....p.......@..P"..............d...................................@...@............................................text............................... ..`.rdata..P*.......,..................@..@.data....S..........................@....pdata..P"...@...$..................@..@.rsrc........p......................@..@.reloc..d...........................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):349696
                                                                                                                                                                                                                                                        Entropy (8bit):7.968250820517949
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:6144:AT1Bgj04zLS/70E7IodJ6vsVzsooEAPmIV49g2/GzrtXAlGSExj76f:Gb45zA7Fv6vsVOzm9t/Gzr9AsdP6f
                                                                                                                                                                                                                                                        MD5:6446A00EB59754E15749AF229B0D5217
                                                                                                                                                                                                                                                        SHA1:69C0311F0B121EB378E90A1DD88925C424C1A07B
                                                                                                                                                                                                                                                        SHA-256:558FE8C705BBD035F886CC02ACEE3FDFA50398E74795F62D182E01225D58E2E2
                                                                                                                                                                                                                                                        SHA-512:63FFDDB80FAA7013DC4C665E1614EE7175D313868636E2D6BC9B8E1FA941134FF425F6F02C64A5509EB97A9BE8BB87A2A9859CD57E72D10B7BBF13887CF0BA58
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 50%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...AL................0..B...........a... ........@.. ....................................`.................................Pa..K....................................a............................................... ............... ..H............text....A... ...B.................. ..`.rsrc................F..............@..@.reloc...............L..............@..B.BSS.................N..............@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):1883136
                                                                                                                                                                                                                                                        Entropy (8bit):7.94769287989194
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:49152:+ZUqbdBAiUW1jWtLeMlQKuEqmHIs0jDzgkzwc+lvQKCN:+ZUqJ8MWtqMlQKubmH30jDz70c+lvF
                                                                                                                                                                                                                                                        MD5:37E85A34D4EC7C387A79E20CE262F2CF
                                                                                                                                                                                                                                                        SHA1:701896F9EDFC48C14CD49A4E521B7516F35A93AD
                                                                                                                                                                                                                                                        SHA-256:4EA639F777465509D3246C1294E7AEE3AE5FCCEEFDA0A0E6492CD40C9200A669
                                                                                                                                                                                                                                                        SHA-512:E8254EF680EB4DB2B3D3412DDD47AE8C700C957C5C0E703FD8A2F10A129978E856E5961CAEA2D9641AF50BFB37E37C506BBDE4B0228BE0C9EAE037C22CB73577
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....vg.................H...........PJ...........@...........................J......=....@.................................Y...m....p.............................................................................................................. . .`..........................@....rsrc........p......................@....idata ............................@... ..*.........................@...gtgwsuzl.....@0.....................@...hkqimwut.....@J.....................@....taggant.0...PJ.."..................@...................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):3104256
                                                                                                                                                                                                                                                        Entropy (8bit):6.625022195702856
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:49152:fWBcAgnnqVX9myu4fWiQbBpZp1xnZ5h6KOXebx6MnF1g:fWCnnqVX9myNOiQb/96RObxlnFe
                                                                                                                                                                                                                                                        MD5:612B785A52C7C281DD891D4835E0E4CE
                                                                                                                                                                                                                                                        SHA1:689A488E8E86D7F820732871FB795D193100C8EC
                                                                                                                                                                                                                                                        SHA-256:DB2E536B6E14A6E936ACBEEC7478624756F82C5A4EAEC9353B4EE7628153970F
                                                                                                                                                                                                                                                        SHA-512:384E22D7D20FB61D1F19672C1A6982532BA54EEFE6A07E97E4CBFAA89E24D2C2FAB7659F000916988159F1F661724205FFC0FC44749B9EFA7ED375B93645698F
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....vg.................H...........p/...........@.........................../.....T\0...@.................................Y...m....p.............................................................................................................. . .`.......`..................@....rsrc........p.......p..............@....idata .............t..............@...ikmnjisi..).......)..v..............@...nmpoliea.....`/......8/.............@....taggant.0...p/.."...</.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):1864192
                                                                                                                                                                                                                                                        Entropy (8bit):7.945598151255693
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:49152:q5eCT3PGWaVABisbebqgoy6zNZ/N5SU9a:q5eCyVKisbrzy6zNMAa
                                                                                                                                                                                                                                                        MD5:8E7317BD5F12DA95C46CA94572B2C331
                                                                                                                                                                                                                                                        SHA1:F4D5D81D5455D2EF430530CA46266CB263C0A4C3
                                                                                                                                                                                                                                                        SHA-256:AF3387F8CF8C8581429C089B8B0CF1C5DADB32F2034EC21DD5A5149EAF8BF4E5
                                                                                                                                                                                                                                                        SHA-512:4A3D839A55AC2CA1AAA56EE4A7F5762BAEE5CDA44F9CBECD93B79188A9BAD1EFF7D3F48ECE83071CF3FA1BA3BC26B1D9E6B7F9DA3317BE4E5291B50617A51281
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L..."&{g.....................*.......pk...........@...........................k...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... ..+...$......|..............@...scpusmou......P......~..............@...wkvcxnam.....`k......L..............@....taggant.0...pk.."...P..............@...................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):969728
                                                                                                                                                                                                                                                        Entropy (8bit):6.7013702693872865
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:24576:wqDEvCTbMWu7rQYlBQcBiT6rprG8am9Weel:wTvC/MTQYxsWR7am9ne
                                                                                                                                                                                                                                                        MD5:A5F4B776FBC130947C7EA91252E30747
                                                                                                                                                                                                                                                        SHA1:B8EE9FDE8E876836E0AE6D1C592950FF743A411E
                                                                                                                                                                                                                                                        SHA-256:0B66B1F82F34FB2C4B7DC1B9EE3A7615D7FF522E9EB57951F0E20E1D944699F0
                                                                                                                                                                                                                                                        SHA-512:0D6A5E150D614F1586BFB1CA8ED1AADD7B7CDF26F1F62436F7535271E22D185D99A35272100CE11F01361DB4A8352A979B265A7BB8962EFCEB411F670C094D8E
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....}g..........".................w.............@..........................0......u.....@...@.......@.....................d...|....@...a.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....a...@...b..................@..@.reloc...u.......v...V..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):2761216
                                                                                                                                                                                                                                                        Entropy (8bit):6.497249856533143
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:49152:qgNclweCw7A75XpD+/ejYAIrMN1FXvJ8D3YwfaXelz0Z:GlweCwc1XpD+2DhvafaXmz0
                                                                                                                                                                                                                                                        MD5:CB31FF98156630BF835768E1C1B47EE1
                                                                                                                                                                                                                                                        SHA1:835B71E4F8F8BE2EE1AF49543CCC80D9DEFE8F78
                                                                                                                                                                                                                                                        SHA-256:EAE09F56D1E647F890D3AE6653B644D41F6A136308C975C044C96F57300DA601
                                                                                                                                                                                                                                                        SHA-512:FFB71102EBFD51A7A22B812A32E645620EA64426EAD190210E99F176DAE50F89320FC142D28EED7F510C28CD48ED41ECCF858D848EED1B498A53D3EAEE83CC79
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............*.. ...`....@.. ........................*.......*...`.................................U...i....`..D........................................................................................................... . .@... ....... ..............@....rsrc...D....`.......2..............@....idata . ...........6..............@...dqmrytmu..).......)..8..............@...pxqnvvkn. ....*.......).............@....taggant.@....*.."....*.............@...................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):1963520
                                                                                                                                                                                                                                                        Entropy (8bit):7.941995285869976
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:49152:8AoagQKVb2LRNKNxePyA0PzhpaVQ2fFw7m8:oaOVq1NKviRX/fFw7Z
                                                                                                                                                                                                                                                        MD5:B87ABAE5DCF781D2DD96D6C8FBBDE6FF
                                                                                                                                                                                                                                                        SHA1:C6590E8C9C86ADC3DF550C72EA04433CEF32398C
                                                                                                                                                                                                                                                        SHA-256:87599BA82297583457EE7FC605D80A3C02F60603CD4BF16428556A834A6DD8BA
                                                                                                                                                                                                                                                        SHA-512:7A2ED19AD0B13C98D5BE1EC69F7718C01AF7FF675C229A11A7726636FAC912E1F7C38098D4895906434DBF73914CDE793C1DA9D1BFE8B9AE55F45979BD0EDF5C
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i...........nG@.....ZR.....ZC.....ZU.................Z\.....ZB.....ZG....Rich...................PE..L....,.e.....................>...................@.................................J.......................................[.A.o.....@.....................................................|Q...................................................... . ..@......N..................@....rsrc.........@..p...^..............@....idata ......A.....................@... .0*...A.....................@...ltmerovd......k.....................@...uydrgwnj............................@....taggant.0......"..................@...........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\1033699001\8c9c7a39f7.exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):1771008
                                                                                                                                                                                                                                                        Entropy (8bit):6.829704744143836
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:24576:CS3RWpdupsY0HhzA6AydDu9H73NvHgTxRnqY33u4citY1HtFPMRWpYp:3idupsYohzA6AydDu9leXu4ciGHi
                                                                                                                                                                                                                                                        MD5:1C0FDE14F7A46816A2E8A747A90E1584
                                                                                                                                                                                                                                                        SHA1:76EDA2D23786BE801521479B6C83D97C16B27879
                                                                                                                                                                                                                                                        SHA-256:D2638065D9C0CF218EFA5E05DC67E282110E854DE56D4A124D3DF57068B2E3E3
                                                                                                                                                                                                                                                        SHA-512:AE60B7D606BB2B8D1AF89CD828386AD33EC85FD75ADB7810EE988445880412E5CD71584327167E839B1F6C6DB5F876F9F88D4BAEB862ABFCE085FA43D70CEC3F
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 37%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........*.7.K.d.K.d.K.dT9.e.K.dT9.e.K.dT9.e3K.dT9.e.K.dT9.e.K.d.K.d.I.d.>.e.K.d.>.e.K.d.>.e.K.d.>.e.K.d.>9d.K.d.KQd.K.d.>.e.K.dRich.K.d........PE..L......`.....................v......T.............@..........................`.......L......................................|+..@....................`.. J..........@...8...........................x...@............................................text............................... ..`.rdata..............................@..@.data...tM...`... ...B..............@....rsrc................b..............@..@........................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\1033700001\24a1c81f44.exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):369152
                                                                                                                                                                                                                                                        Entropy (8bit):7.933865064723301
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:6144:C9Y1yj7QbH9cmXVllnABXgebDPBG414r3drK+4rTp3kzVIBhVpwqskhmyAx5a1K7:a9j7QbH9zllABzDpZ14Bj4rTxMVIVpPu
                                                                                                                                                                                                                                                        MD5:7AE95FCD206995D8FDA2FF624463FE49
                                                                                                                                                                                                                                                        SHA1:18942C4E99F09F2838EB3DA8F5ECCFCD1551645B
                                                                                                                                                                                                                                                        SHA-256:CB8DDA761937E236727EA5D37C8572ED239C0C511F0C81B2C5A6B54E3C8D478F
                                                                                                                                                                                                                                                        SHA-512:CA2C4296EFB88B0FC346E3AC3D22939278F99EA39D42E2F90CE32A25F3D2F0E1A6933B84999B84A7233EAF45C6B6C58A1426783DC98B8F960DBD7E846197FB6D
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Yara Hits:
                                                                                                                                                                                                                                                        • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\1033700001\24a1c81f44.exe, Author: Joe Security
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 45%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....C,...............0.................. ........@.. ....................... ............`.................................p...K.......B..........................."................................................ ............... ..H............text....... ...................... ..`.rsrc...B...........................@..@.reloc..............................@..B.bss................................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\1033701001\01c00b6fe2.exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):4486656
                                                                                                                                                                                                                                                        Entropy (8bit):7.984911176545157
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:98304:o/eaCc5VyK7PPmzg4+c19Z/4jOA7EPR6gYXVFqcLas:8NBd2P/qePR6gcocLa
                                                                                                                                                                                                                                                        MD5:F8AF2AA72956A4C4DE223ABA02173783
                                                                                                                                                                                                                                                        SHA1:DDD07603C84296B43597B489B13465936489F1CD
                                                                                                                                                                                                                                                        SHA-256:14D7083C6C1E5525FBA1CB9DBF1F583A0E57776AACC59D736BFE9D80AC615AFC
                                                                                                                                                                                                                                                        SHA-512:D2427DE976D1690437391E285E6CB94D8CB6C746EFD476D6C56F40FBCD9D5FA46BDE29E4DCA7C4E57938C5CB5ED15DF1769BEF7359CC78676FF2ED4B965C1604
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....a{g...............(..J...h..2............J...@..........................0........D...@... ............................._.f.s.....e...............h.....4..................................................................................... . ..e.......(.................@....rsrc.........e.......(.............@....idata ......f.......(.............@... .09...f.......(.............@...xpqdeyne.....@........(.............@...nykjqzsf............ND.............@....taggant.0......."...TD.............@...........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\1033702001\31f59e2a09.exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):500224
                                                                                                                                                                                                                                                        Entropy (8bit):6.9993751003868185
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:12288:R3fscf4y94gU6rfENQ9zAsfwlpbjLkV/qXzyi1MR:R30g4y94mr8izAsybPkV6
                                                                                                                                                                                                                                                        MD5:9BF8B21D5ABECC43F525F3A2C8C1E20B
                                                                                                                                                                                                                                                        SHA1:5779681435EE1BCB22C610656E00A06FBF2D353F
                                                                                                                                                                                                                                                        SHA-256:22000D5648CBAADD7B84456DD52F9F57ECB972AC39CB47AAD330E4DE6390B7DA
                                                                                                                                                                                                                                                        SHA-512:5E7AFDC93D2A66A4C8FC671AB3922D18163EE2690EE5828D5C8BA9801E48DF9D1DC32B3BF929BCA57F6A79294DB790FEF8957E2BB43CE5D91E3D678AF3152E74
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 39%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....{g..............0.............N.... ........@.. ....................................@.....................................W.......6............................................................................ ............... ..H............text...T.... ...................... ..`.rsrc...6...........................@..@.reloc..............................@..B................0.......H...........$.......\...................................................gZ$.....................t.................................................h.`LKA.DBEMBSG.QSFFE@.RO.B?F.KF.pea.GEPO.............h.....Y...Y...Y._.Z$..Y._.Z...Y._.Z%..Y._.Z...Y...Y...Y...Y...Y.\.Z/..Y.\.Z ..Y.\.Z%..Y...Y...Y^\.Z...Y^\.Z...YbKQL...Y........do..h.....9M....................$.......;.......t...........................................t.........................$...8.......d...................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\1033703001\ba5ccf6bd8.exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):1038693
                                                                                                                                                                                                                                                        Entropy (8bit):7.892980238860217
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:24576:YLA96z4S/zCtTFL/qcF8UReLbpPEwpA0jg8Zg:mA6/EFO+8selrpm
                                                                                                                                                                                                                                                        MD5:89841D2045725C18C80011B9CE901B4E
                                                                                                                                                                                                                                                        SHA1:CB27F6A88454817FB675D1288C0AC455BE1AC42B
                                                                                                                                                                                                                                                        SHA-256:E064EEAB25A47FD1D9B0BF40C8A82254E5F3A5EBB332129F6B91F7E7B6D60A91
                                                                                                                                                                                                                                                        SHA-512:255AA3D8F3AEE82D92B0669D0438A4612FEB48295032C1D97E5FE7A251EDC857C726A4A98ADDF9A69A40192D39DDD335B4F9EB1C6094CF63F456E3E8C512F10C
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 11%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ`.....................@...................................`...........!..L.!Require Windows..$PE..d......L..........#..........8......d..........@.............................0......7................................................................p.......P..........`Z...........................................................................................text............................... ..`.rdata..lR.......T..................@..@.data..../... ......................@....pdata.......P......................@..@.rsrc........p.......*..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\1033704001\a85084d20f.exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):67072
                                                                                                                                                                                                                                                        Entropy (8bit):7.123316522551807
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:1536:CeNyuZ4UbqcHd7XcdyazUUGyvV3xbibHPgosH:McbqcHd7McKjUIou
                                                                                                                                                                                                                                                        MD5:9D55F610F83116A12DD6DB6B6261AAF2
                                                                                                                                                                                                                                                        SHA1:2502C6C4565FE231B849D69F08485120698FB01C
                                                                                                                                                                                                                                                        SHA-256:3995C65E4F9C94B2E583A92293D5FC8518363BB1B08C62E2D7C613F1B1AC1CBE
                                                                                                                                                                                                                                                        SHA-512:E6FD48CF8C4862FEFA66F0E4C71C723FAF508D694760CC48EF49921D822E959398C997D31956FAA2C8B9F21C8A8DF1223AC6DA9A5A63D694C7E0F034284C3BC4
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Yara Hits:
                                                                                                                                                                                                                                                        • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\1033704001\a85084d20f.exe, Author: Joe Security
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 52%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....C,...............0.................. ........@.. ...............................p....`.................................p...K.......B..........................."................................................ ............... ..H............text....... ...................... ..`.rsrc...B...........................@..@.reloc..............................@..B.bss.....v.......v..................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\1033705001\54d18f4f90.exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):439296
                                                                                                                                                                                                                                                        Entropy (8bit):6.489951590243045
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:12288:24RGSlxPlNjb1kaVKfpy4FjMSkhCzL7ARDWb:5lNbKTZMzO4RDY
                                                                                                                                                                                                                                                        MD5:CD0C9B8F92C8BE5F0044145E99E98D43
                                                                                                                                                                                                                                                        SHA1:698637B2A7FD4740A6B96A736B82FFFB0CE67819
                                                                                                                                                                                                                                                        SHA-256:68F60B3ECF60546520E15E442401384703B5436F6F7224BCC6F92B4CA24BABA6
                                                                                                                                                                                                                                                        SHA-512:033B7FFF79F9AF35E92781AAADA06A55619EDDCF7D4BC40FD7EE027627E6AE770F96F2A11148392E64EF2495F30A90DD2486115EF1A7FB1408678FD14E17E5C2
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Yara Hits:
                                                                                                                                                                                                                                                        • Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Temp\1033705001\54d18f4f90.exe, Author: Joe Security
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 55%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........BS..,...,...,.../...,...).#.,..(...,../...,..)...,.......,...(...,...-...,...-.j.,.U.%...,.U.....,.U.....,.Rich..,.........PE..L....Uhg............................'.............@..........................0............@..................................E...................................E......8...............................@...............<............................text...j........................... ..`.rdata...H.......J..................@..@.data....m...`...,...@..............@....rsrc................l..............@..@.reloc...E.......F...n..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\1033706001\4e6501ac3b.exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):366592
                                                                                                                                                                                                                                                        Entropy (8bit):7.932557778611599
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:6144:p9XhFJ2ZJUzLhX+oRdfvl/HxkU++Ql36XMMs7cVRK85xm9tGRDytvl6D5wykAVY:PrJsJUzLhJ3l/RkU+b3lAVDgTGROtt6s
                                                                                                                                                                                                                                                        MD5:CCB04B4CABC97CF7EE795375C67CADEF
                                                                                                                                                                                                                                                        SHA1:F00D48BB8B35385C9FA3F642A87E354CE81A975E
                                                                                                                                                                                                                                                        SHA-256:2F96884BCF44E4E75181C8E0EBB9C8FB3AE58479E91E995EBCED6490291ED19D
                                                                                                                                                                                                                                                        SHA-512:8F79DCBAB8940EF6A08607CC3CECA35DBEDFCFC6492E07705A4878DFD3433186447E4E1F1BCEBCE57C6B36F5FDD97F99066232B4C4F8DE986DBDDFF2F725BD90
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Yara Hits:
                                                                                                                                                                                                                                                        • Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\1033706001\4e6501ac3b.exe, Author: Joe Security
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 83%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....C,...............0.................. ........@.. ....................... .......G....`.................................p...K.......B..........................."................................................ ............... ..H............text....... ...................... ..`.rsrc...B...........................@..@.reloc..............................@..B.bss................................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\1033707001\a0d135de95.exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):9578331
                                                                                                                                                                                                                                                        Entropy (8bit):7.579199063799339
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:196608:UxB14xuTMS+BPC2cZ07LqyUl7m6/ZTYtSx0USapM7KxBx:YL4QTz+YZ0/qXjpYteX
                                                                                                                                                                                                                                                        MD5:8EA30ACC005292F38B5B3886F244B2A9
                                                                                                                                                                                                                                                        SHA1:FEAAEEF18B6D2A5A2B974B5A32D970E8D9356321
                                                                                                                                                                                                                                                        SHA-256:77D5C3A637603FEF747234B246F206CB3AC8200BC018A4D78D437FE80B0D071F
                                                                                                                                                                                                                                                        SHA-512:77910C47AC6C57982DB81DA036A0C78CA43792EDB7F91D2E07903AB4A833C528F9C13100745D801C06B5649672E00BFDA5475BC25C17FB2D7EEAC0DE9981697F
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 22%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[F.$.'`w.'`w.'`w..w.'`w..w.'`w.ydv.'`w..w.'`w..w.'`w..w_'`w.P.w.'`w.'aw.&`w.P.w.'`w..w2'`w..w.'`w.'.w.'`w..w.'`wRich.'`w................PE..L...P.,a.............................6............@.......................................@.................................\F..........t....................`...j..@...8...............................@....................B.......................text............................... ..`.rdata..T...........................@..@.data...XI...p...$...L..............@....rsrc...t............p..............@..@.reloc.......`......................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\F92YSIFAGW8CC4SRE.exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):1864192
                                                                                                                                                                                                                                                        Entropy (8bit):7.945598151255693
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:49152:q5eCT3PGWaVABisbebqgoy6zNZ/N5SU9a:q5eCyVKisbrzy6zNMAa
                                                                                                                                                                                                                                                        MD5:8E7317BD5F12DA95C46CA94572B2C331
                                                                                                                                                                                                                                                        SHA1:F4D5D81D5455D2EF430530CA46266CB263C0A4C3
                                                                                                                                                                                                                                                        SHA-256:AF3387F8CF8C8581429C089B8B0CF1C5DADB32F2034EC21DD5A5149EAF8BF4E5
                                                                                                                                                                                                                                                        SHA-512:4A3D839A55AC2CA1AAA56EE4A7F5762BAEE5CDA44F9CBECD93B79188A9BAD1EFF7D3F48ECE83071CF3FA1BA3BC26B1D9E6B7F9DA3317BE4E5291B50617A51281
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L..."&{g.....................*.......pk...........@...........................k...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... ..+...$......|..............@...scpusmou......P......~..............@...wkvcxnam.....`k......L..............@....taggant.0...pk.."...P..............@...................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\ITH3569MCVRCZNYE5XQ77V.exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):3266048
                                                                                                                                                                                                                                                        Entropy (8bit):6.660535254211377
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:49152:f8b8hJPihGwpbG0jjgdqtjGPzXbRIo9HleY4srXld:f08hBihGwpbG0jjgdqtqr4O
                                                                                                                                                                                                                                                        MD5:F54491FDB13ECAB8B06510F1C8431032
                                                                                                                                                                                                                                                        SHA1:2E42F6E1A1A559A6EA6DBB974F68D3F598E568FC
                                                                                                                                                                                                                                                        SHA-256:40ADBA8FC61052A26BAEB280F4645287CE1390E81BA42FF57B746F71B1C9F623
                                                                                                                                                                                                                                                        SHA-512:974BEE8B43F27CFD9D3539C9B2A9BAB886B0A91141DDEF9362846B7424773C5D4BE5BB88D1CA3905D7DA06C2315A69494D064926896212237AE0057A72938E0B
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 58%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................2.....'.1...@.................................W...k.............................1...............................1..................................................... . ............................@....rsrc...............................@....idata ............................@...sihywpwu. +.......+.................@...snftdmjr......1.......1.............@....taggant.0....1.."....1.............@...........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_ARC4.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):11264
                                                                                                                                                                                                                                                        Entropy (8bit):4.640339306680604
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:192:dLklddyTHThob0q/tJRrlDfNYSOcqgYCWt:ZgcdZq/JJD6gRWt
                                                                                                                                                                                                                                                        MD5:BCD8CAAF9342AB891BB1D8DD45EF0098
                                                                                                                                                                                                                                                        SHA1:EE7760BA0FF2548F25D764F000EFBB1332BE6D3E
                                                                                                                                                                                                                                                        SHA-256:78725D2F55B7400A3FCAFECD35AF7AEB253FBC0FFCDF1903016EB0AABD1B4E50
                                                                                                                                                                                                                                                        SHA-512:8B6FB53AECB514769985EBFDAB1B3C739024597D9C35905E04971D5422256546F7F169BF98F9BAF7D9F42A61CFF3EE7A20664989D3000773BF5EDA10CB3A0C24
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...Y..f.........." ................P........................................p............`..........................................'......0(..d....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata..Z.... ......................@..@.data...H....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..(....`.......*..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_Salsa20.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):13824
                                                                                                                                                                                                                                                        Entropy (8bit):5.0194545642425075
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:192:4t/1nCuqaL0kt7AznuRmceS4lDFhAlcqgcLg:F/k1ACln4lDogcLg
                                                                                                                                                                                                                                                        MD5:F19CB847E567A31FAB97435536C7B783
                                                                                                                                                                                                                                                        SHA1:4C8BFE404AF28C1781740E7767619A5E2D2FF2B7
                                                                                                                                                                                                                                                        SHA-256:1ECE1DC94471D6977DBE2CEEBA3764ADF0625E2203D6257F7C781C619D2A3DAD
                                                                                                                                                                                                                                                        SHA-512:382DC205F703FC3E1F072F17F58E321E1A65B86BE7D9D6B07F24A02A156308A7FEC9B1A621BA1F3428FD6BB413D14AE9ECB2A2C8DD62A7659776CFFDEBB6374C
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...Z..f.........." ................P.....................................................`..........................................8......H9..d....`.......P..L............p..(....1...............................1..8............0...............................text...h........................... ..`.rdata..r....0......................@..@.data...H....@.......,..............@....pdata..L....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_chacha20.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):13312
                                                                                                                                                                                                                                                        Entropy (8bit):5.037456384995606
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:192:st/1nCuqaL0ktPMn1ENe3erKr5br0YbsiDw6a9lkOcqgRGd:p/kpMIodrXbsiDS95gRGd
                                                                                                                                                                                                                                                        MD5:DC14677EA8A8C933CC41F9CCF2BEDDC1
                                                                                                                                                                                                                                                        SHA1:A6FB87E8F3540743097A467ABE0723247FDAF469
                                                                                                                                                                                                                                                        SHA-256:68F081E96AE08617CF111B21EDED35C1774A5EF1223DF9A161C9445A78F25C73
                                                                                                                                                                                                                                                        SHA-512:3ABA4CFCBBE4B350AB3230D488BD75186427E3AAAF38D19E0E1C7330F16795AD77FB6E26FF39AF29EAF4F5E8C42118CB680F90AFBFCA218AEDA64DC444675BA2
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...Z..f.........." ................P.....................................................`......................................... 8.......8..d....`.......P..d............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..d....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..(....p.......2..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_pkcs1_decode.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):14336
                                                                                                                                                                                                                                                        Entropy (8bit):5.09191874780435
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:192:rMVsiXeqVb0lIb0Pj5Jdfpm68WZDInU282tacqgYLg:rM7ali0Pj5JxCaDuUlgYLg
                                                                                                                                                                                                                                                        MD5:C09BB8A30F0F733C81C5C5A3DAD8D76D
                                                                                                                                                                                                                                                        SHA1:46FD3BA87A32D12F4EE14601D1AD73B78EDC81D1
                                                                                                                                                                                                                                                        SHA-256:8A1B751DB47CE7B1D3BD10BEBFFC7442BE4CFB398E96E3B1FF7FB83C88A8953D
                                                                                                                                                                                                                                                        SHA-512:691AC74FAE930E9CEABE782567EFB99C50DD9B8AD607DD7F99A5C7DF2FA2BEB7EDFE2EBB7095A72DA0AE24E688FBABD340EAE8B646D5B8C394FEE8DDD5E60D31
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d...X..f.........." ................P.....................................................`.........................................`8.......8..d....`.......P..(............p..(....1...............................1..8............0...............................text............................... ..`.rdata..6....0....... ..............@..@.data...x....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_aes.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):36352
                                                                                                                                                                                                                                                        Entropy (8bit):6.541423493519083
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:384:f/UlZA5PUEllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr52EkifcMxme:klcR7JriEbwDaS4j990th9VDBV
                                                                                                                                                                                                                                                        MD5:0AB25F99CDAACA6B11F2ECBE8223CAD5
                                                                                                                                                                                                                                                        SHA1:7A881B3F84EF39D97A31283DE6D7B7AE85C8BAE6
                                                                                                                                                                                                                                                        SHA-256:6CE8A60D1AB5ADC186E23E3DE864D7ADF6BDD37E3B0C591FA910763C5C26AF60
                                                                                                                                                                                                                                                        SHA-512:11E89EEF34398DF3B144A0303E08B3A4CAF41A9A8CA618C18135F561731F285F8CF821D81179C2C45F6EEB0E496D9DD3ECF6FF202A3C453C80AFEF8582D06C17
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...V..f.........." .....H...H......P.....................................................`.........................................p...........d...............................0......................................8............`...............................text...xG.......H.................. ..`.rdata.."6...`...8...L..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_aesni.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):15360
                                                                                                                                                                                                                                                        Entropy (8bit):5.367749645917753
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:192:YiJBj5fq/Rk0kPLhOZ3UucCWuSKPEkA2bD9JXx03cqg5YUMLgs:/k1kTMZEjCWNaA2DTx0g5YUMLg
                                                                                                                                                                                                                                                        MD5:B6EA675C3A35CD6400A7ECF2FB9530D1
                                                                                                                                                                                                                                                        SHA1:0E41751AA48108D7924B0A70A86031DDE799D7D6
                                                                                                                                                                                                                                                        SHA-256:76EF4C1759B5553550AB652B84F8E158BA8F34F29FD090393815F06A1C1DC59D
                                                                                                                                                                                                                                                        SHA-512:E31FD33E1ED6D4DA3957320250282CFD9EB3A64F12DE4BD2DFE3410F66725164D96B27CAA34C501D1A535A5A2442D5F070650FD3014B4B92624EE00F1C3F3197
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.z.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...V..f.........." ......... ......P.....................................................`..........................................9......$:..d....`.......P...............p..(....1...............................1..8............0.. ............................text............................... ..`.rdata.......0......."..............@..@.data...8....@.......2..............@....pdata.......P.......4..............@..@.rsrc........`.......8..............@..@.reloc..(....p.......:..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_arc2.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):16384
                                                                                                                                                                                                                                                        Entropy (8bit):5.41148259289073
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:192:w3d9FkHaz0EJvrj+CYuz7ucc9dG7otDr22KcqgOiewZjW:YkHEJzj+X6769lDzagO/w
                                                                                                                                                                                                                                                        MD5:F14E1AA2590D621BE8C10321B2C43132
                                                                                                                                                                                                                                                        SHA1:FD84D11619DFFDF82C563E45B48F82099D9E3130
                                                                                                                                                                                                                                                        SHA-256:FCE70B3DAFB39C6A4DB85D2D662CB9EB9C4861AA648AD7436E7F65663345D177
                                                                                                                                                                                                                                                        SHA-512:A86B9DF163007277D26F2F732ECAB9DBCA8E860F8B5809784F46702D4CEA198824FDEF6AB98BA7DDC281E8791C10EABA002ABDA6F975323B36D5967E0443C1E4
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." ....."... ......P.....................................................`.........................................pI.......J..d....p.......`..................(....B...............................B..8............@...............................text...( .......".................. ..`.rdata..<....@.......&..............@..@.data...H....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..(............>..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_blowfish.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):20992
                                                                                                                                                                                                                                                        Entropy (8bit):6.041302713678401
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:384:kUX0JfbRz5MLZA0nmwzMDYpJgLa0Mp8NDBcxgprAM:6NbRzWXwDqgLa1uBfP
                                                                                                                                                                                                                                                        MD5:B127CAE435AEB8A2A37D2A1BC1C27282
                                                                                                                                                                                                                                                        SHA1:2A7BF8BF7F24B2381370BA6B41FB640EE42BDCCD
                                                                                                                                                                                                                                                        SHA-256:538B1253B5929254ED92129FA0957DB26CDDF34A8372BA0BF19D20D01549ADA3
                                                                                                                                                                                                                                                        SHA-512:4FE027E46D5132CA63973C67BD5394F2AC74DD4BBCFE93CB16136FAB4B6BF67BECB5A0D4CA359FF9426DA63CA81F793BBF1B79C8A9D8372C53DCB5796D17367E
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." .....$...0......P.....................................................`.........................................0Y.......Y..d............p..................0....Q...............................R..8............@...............................text....".......$.................. ..`.rdata.......@... ...(..............@..@.data...H....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..0............P..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_cast.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):24576
                                                                                                                                                                                                                                                        Entropy (8bit):6.530656045206549
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:384:cEDwUBi9SPu71omZXmrfXA+UA10ol31tuXVYdAgYj:FsUBXmoEXmrXA+NNxWFYfo
                                                                                                                                                                                                                                                        MD5:2E15AA6F97ED618A3236CFA920988142
                                                                                                                                                                                                                                                        SHA1:A9D556D54519D3E91FA19A936ED291A33C0D1141
                                                                                                                                                                                                                                                        SHA-256:516C5EA47A7B9A166F2226ECBA79075F1A35EFFF14D87E00006B34496173BB78
                                                                                                                                                                                                                                                        SHA-512:A6C75C4A285753CC94E45500E8DD6B6C7574FB7F610FF65667F1BEC8D8B413FC10514B7D62F196C2B8D017C308C5E19E2AEF918021FA81D0CB3D8CED37D8549A
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...W..f.........." .....$...>............................................................`..........................................h.......i..d...............................0....a...............................a..8............@...............................text....#.......$.................. ..`.rdata..:-...@.......(..............@..@.data...H....p.......V..............@....pdata...............X..............@..@.rsrc................\..............@..@.reloc..0............^..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_cbc.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):12288
                                                                                                                                                                                                                                                        Entropy (8bit):4.7080156150187396
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:192:lF/1n7Guqaj0ktfEJwX1fYwCODR3lncqg0Gd6l:RGXkJEm1feODxDg0Gd6
                                                                                                                                                                                                                                                        MD5:40390F2113DC2A9D6CFAE7127F6BA329
                                                                                                                                                                                                                                                        SHA1:9C886C33A20B3F76B37AA9B10A6954F3C8981772
                                                                                                                                                                                                                                                        SHA-256:6BA9C910F755885E4D356C798A4DD32D2803EA4CFABB3D56165B3017D0491AE2
                                                                                                                                                                                                                                                        SHA-512:617B963816838D649C212C5021D7D0C58839A85D4D33BBAF72C0EC6ECD98B609080E9E57AF06FA558FF302660619BE57CC974282826AB9F21AE0D80FBAA831A1
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...X..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..(....p......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_cfb.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):12800
                                                                                                                                                                                                                                                        Entropy (8bit):5.159963979391524
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:192:kblRgfeqfz0RP767fB4A84DgVD6eDcqgzbkLgmf:BwRj67p84Dg6eVgzbkLgmf
                                                                                                                                                                                                                                                        MD5:899895C0ED6830C4C9A3328CC7DF95B6
                                                                                                                                                                                                                                                        SHA1:C02F14EBDA8B631195068266BA20E03210ABEABC
                                                                                                                                                                                                                                                        SHA-256:18D568C7BE3E04F4E6026D12B09B1FA3FAE50FF29AC3DEAF861F3C181653E691
                                                                                                                                                                                                                                                        SHA-512:0B4C50E40AF92BC9589668E13DF417244274F46F5A66E1FC7D1D59BC281969BA319305BECEA119385F01CC4603439E4B37AFA2CF90645425210848A02839E3E7
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^..6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...Jk.7?...J..7?..Rich6?..................PE..d...Y..f.........." ................P.....................................................`..........................................8......x9..d....`.......P..d............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......(..............@....pdata..d....P.......*..............@..@.rsrc........`......................@..@.reloc..(....p.......0..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_ctr.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):14848
                                                                                                                                                                                                                                                        Entropy (8bit):5.270418334522813
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:192:vktJ1gifqQGRk0IP73AdXdmEEEEEm9uhiFEQayDZVMcqgnF6+6Lg:vkdU1ID3AdXd49urQPDggnUjLg
                                                                                                                                                                                                                                                        MD5:C4C525B081F8A0927091178F5F2EE103
                                                                                                                                                                                                                                                        SHA1:A1F17B5EA430ADE174D02ECC0B3CB79DBF619900
                                                                                                                                                                                                                                                        SHA-256:4D86A90B2E20CDE099D6122C49A72BAE081F60EB2EEA0F76E740BE6C41DA6749
                                                                                                                                                                                                                                                        SHA-512:7C06E3E6261427BC6E654B2B53518C7EAA5F860A47AE8E80DC3F8F0FED91E122CB2D4632188DC44123FB759749B5425F426CD1153A8F84485EF0491002B26555
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^z.6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...J..7?...J..7?..Rich6?..........................PE..d...Y..f.........." ......... ......P.....................................................`.........................................`9.......:..d....`.......P...............p..(....1...............................1..8............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..(....p.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_des.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):56832
                                                                                                                                                                                                                                                        Entropy (8bit):4.231032526864278
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:384:0qcmHBeNL1dO/qHkpnYcZiGKdZHDLY84vnKAnK2rZA21agVF:fEiqHHx4vZDV
                                                                                                                                                                                                                                                        MD5:F9E266F763175B8F6FD4154275F8E2F0
                                                                                                                                                                                                                                                        SHA1:8BE457700D58356BC2FA7390940611709A0E5473
                                                                                                                                                                                                                                                        SHA-256:14D2799BE604CBDC668FDE8834A896EEE69DAE0E0D43B37289FCCBA35CEF29EC
                                                                                                                                                                                                                                                        SHA-512:EB3E37A3C3FF8A65DEF6FA20941C8672A8197A41977E35AE2DC6551B5587B84C2703758320559F2C93C0531AD5C9D0F6C36EC5037669DC5CE78EB3367D89877B
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d...X..f.........." .....6...................................................0............`.................................................\...d...............l............ ..0... ...............................@...8............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...H...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_des3.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):57344
                                                                                                                                                                                                                                                        Entropy (8bit):4.252429732285762
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:384:J4cmHBeIzNweVy/CHkRnYcZiGKdZHDLq80vnKAnKBrZGsURygUX:GEO6CHnX0vZb7
                                                                                                                                                                                                                                                        MD5:DECF524B2D53FCD7D4FA726F00B3E5FC
                                                                                                                                                                                                                                                        SHA1:E87C6ED4004F2772B888C5B5758AA75FE99D2F6F
                                                                                                                                                                                                                                                        SHA-256:58F7053EE70467D3384C73F299C0DFD63EEF9744D61D1980D9D2518974CA92D4
                                                                                                                                                                                                                                                        SHA-512:EAFF4FD80843743E61CE635FBADF4E5D9CF2C3E97F3C48350BD9E755F4423AC6867F9FE8746BD5C54E1402B18E8A55AEEF7ACA098C7CF4186DC4C1235EB35DF2
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d...X..f.........." .....8...................................................0............`.....................................................d............................ ..0... ...............................@...8............P...............................text...X7.......8.................. ..`.rdata......P.......<..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_ecb.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):10240
                                                                                                                                                                                                                                                        Entropy (8bit):4.690163963718492
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:192:Yddz2KTnThIz0qfteRY4zp+D3PLui8p1cqgHCWt:k2E9RqfCXp+D3juRpLgiWt
                                                                                                                                                                                                                                                        MD5:80BB1E0E06ACAF03A0B1D4EF30D14BE7
                                                                                                                                                                                                                                                        SHA1:B20CAC0D2F3CD803D98A2E8A25FBF65884B0B619
                                                                                                                                                                                                                                                        SHA-256:5D1C2C60C4E571B88F27D4AE7D22494BED57D5EC91939E5716AFA3EA7F6871F6
                                                                                                                                                                                                                                                        SHA-512:2A13AB6715B818AD62267AB51E55CD54714AEBF21EC9EA61C2AEFD56017DC84A6B360D024F8682A2E105582B9C5FE892ECEBD2BEF8A492279B19FFD84BC83FA5
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...X..f.........." ................P........................................p............`.........................................0'.......'..P....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_eksblowfish.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):22016
                                                                                                                                                                                                                                                        Entropy (8bit):6.1215844022564285
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:384:nUX0JfbRwUtPMbNv37t6K5jwbDEpJgLa0Mp8xCkgJrAm:jNbRw8EbxwKBwbD+gLa1nh
                                                                                                                                                                                                                                                        MD5:3727271FE04ECB6D5E49E936095E95BC
                                                                                                                                                                                                                                                        SHA1:46182698689A849A8C210A8BF571D5F574C6F5B1
                                                                                                                                                                                                                                                        SHA-256:3AF5B35DCD5A3B6C7E88CEE53F355AAFFF40F2C21DABD4DE27DBB57D1A29B63B
                                                                                                                                                                                                                                                        SHA-512:5BED1F4DF678FE90B8E3F1B7C4F68198463E579209B079CB4A40DCAC01CE26AA2417DBE029B196F6F2C6AFAD560E2D1AF9F089ABE37EAD121CA10EE69D9659ED
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Antivirus:
                                                                                                                                                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." .....(...0......P.....................................................`.........................................0Y.......Y..d............p..................0....Q...............................R..8............@...............................text...H'.......(.................. ..`.rdata.......@... ...,..............@..@.data...H....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..0............T..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_ocb.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):17920
                                                                                                                                                                                                                                                        Entropy (8bit):5.293810509074883
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:384:4PHoDUntQjNB+/yw/pogeXOvXoTezczOo3p9iJgDQ3iNgnVbwhA:dUOhBcDRogeXOfoTezcio3pUJgDQ3i+
                                                                                                                                                                                                                                                        MD5:78AEF441C9152A17DD4DC40C7CC9DF69
                                                                                                                                                                                                                                                        SHA1:6BB6F8426AFA6522E647DFC82B1B64FAF3A9781F
                                                                                                                                                                                                                                                        SHA-256:56E4E4B156295F1AAA22ECB5481841DE2A9EB84845A16E12A7C18C7C3B05B707
                                                                                                                                                                                                                                                        SHA-512:27B27E77BE81B29D42359FE28531225383860BCD19A79044090C4EA58D9F98009A254BF63585979C60B3134D47B8233941ABB354A291F23C8641A4961FA33107
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...Y..f.........." .....(... ......P.....................................................`.........................................pI......lJ..d....p.......`..................(....A...............................A..8............@...............................text....'.......(.................. ..`.rdata.......@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..(............D..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Cipher\_raw_ofb.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):11776
                                                                                                                                                                                                                                                        Entropy (8bit):4.862619033406922
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:96:0Ga+F/1NtJ9t4udqaj01rlALnNNJSS2sP+YEdMN+F9FdKaWDULk+VOmWbucX6gR7:PF/1n7Guqaj0ktfEON+bMDUlJcqg0Gd
                                                                                                                                                                                                                                                        MD5:19E0ABF76B274C12FF624A16713F4999
                                                                                                                                                                                                                                                        SHA1:A4B370F556B925F7126BF87F70263D1705C3A0DB
                                                                                                                                                                                                                                                        SHA-256:D9FDA05AE16C5387AB46DC728C6EDCE6A3D0A9E1ABDD7ACB8B32FC2A17BE6F13
                                                                                                                                                                                                                                                        SHA-512:D03033EA5CF37641FBD802EBEB5019CAEF33C9A78E01519FEA88F87E773DCA92C80B74BA80429B530694DAD0BFA3F043A7104234C7C961E18D48019D90277C8E
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...Y..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......$..............@....pdata..X....P.......&..............@..@.rsrc........`.......*..............@..@.reloc..(....p.......,..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_BLAKE2b.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):14336
                                                                                                                                                                                                                                                        Entropy (8bit):5.227045547076371
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:192:saF/1n7Guqaj0ktrE8o2o+V2rQnjt1wmg9jtveDn4clG6VcqgOvgdd:swGXkFE8Zo+AojO9jZeDf5rgOvgz
                                                                                                                                                                                                                                                        MD5:309D6F6B0DD022EBD9214F445CAC7BB9
                                                                                                                                                                                                                                                        SHA1:ABD22690B7AD77782CFC0D2393D0C038E16070B0
                                                                                                                                                                                                                                                        SHA-256:4FBE188C20FB578D4B66349D50AA6FFE4AB86844FB6427C57738F36780D1E2E2
                                                                                                                                                                                                                                                        SHA-512:D1951FE92F83E7774E8E877815BED6E6216D56EF18B7F1C369D678CB6E1814243659E9FA7ABC0D22FB5B34A9D50A51D5A89BA00AE1FDD32157FD0FF9902FB4B7
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..@............p..(....2...............................2..8............0...............................text...x........................... ..`.rdata.......0....... ..............@..@.data...H....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_BLAKE2s.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):13824
                                                                                                                                                                                                                                                        Entropy (8bit):5.176369829782773
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:192:rF/1n7Guqaj0ktrESsrUW+SBjsK5tcQmEreD2mf1AoxkVcqgOvgXQ:rGXkFE/UW575tA2eDp1Ao2rgOvgX
                                                                                                                                                                                                                                                        MD5:D54FEB9A270B212B0CCB1937C660678A
                                                                                                                                                                                                                                                        SHA1:224259E5B684C7AC8D79464E51503D302390C5C9
                                                                                                                                                                                                                                                        SHA-256:032B83F1003A796465255D9B246050A196488BAC1260F628913E536314AFDED4
                                                                                                                                                                                                                                                        SHA-512:29955A6569CA6D039B35BB40C56AEEB75FC765600525D0B469F72C97945970A428951BAB4AF9CD21B3161D5BBA932F853778E2674CA83B14F7ABA009FA53566F
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..@............p..(....2...............................2..8............0...............................text...h........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata..@....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_MD2.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):14336
                                                                                                                                                                                                                                                        Entropy (8bit):5.047563322651927
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:384:6alCvH32p3/2pnEhKnLg9yH8puzoFaPERIQAvHD9CIg5kP:5CvHmp3OpnEhmLg9yH8puzoFaPERIQgI
                                                                                                                                                                                                                                                        MD5:52DCD4151A9177CF685BE4DF48EA9606
                                                                                                                                                                                                                                                        SHA1:F444A4A5CBAE9422B408420115F0D3FF973C9705
                                                                                                                                                                                                                                                        SHA-256:D54375DC0652358A6E4E744F1A0EAEEAD87ACCD391A20D6FF324FE14E988A122
                                                                                                                                                                                                                                                        SHA-512:64C54B89F2637759309ECC6655831C3A6755924ED70CBC51614061542EB9BA9A8AECF6951EB3AB92447247DC4D7D846C88F4957DBBE4484A9AB934343EE27178
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...Q..f.........." ......... ......P.....................................................`.........................................@9.......9..d....`.......P..(............p..(....2...............................2..8............0...............................text...X........................... ..`.rdata..@....0......................@..@.data...x....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_MD4.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):13824
                                                                                                                                                                                                                                                        Entropy (8bit):5.09893680790018
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:192:xsiXeqVb0lwbH4P01sAD7I/9hAkwDWzBEbcqgqLg:valqH4M1sAD7KvpwDFtgqLg
                                                                                                                                                                                                                                                        MD5:F929B1A3997427191E07CF52AC883054
                                                                                                                                                                                                                                                        SHA1:C5EA5B68586C2FB09E5FDD20D4DD616D06F5CBA6
                                                                                                                                                                                                                                                        SHA-256:5386908173074FABD95BF269A9DF0A4E1B21C0576923186F449ABF4A820F6A8E
                                                                                                                                                                                                                                                        SHA-512:2C79DBCE2C21214D979AB86DD989D41A3AFA7FCB7F3B79BA9974E2EE8F832DD7CA20C1C87C0C380DB037D776FE6D0851D60AD55A08AFDE0003B7E59214DD2F3B
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ................P.....................................................`.........................................08.......8..d....`.......P..(............p..(....1...............................2..8............0...............................text............................... ..`.rdata..0....0......................@..@.data........@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_MD5.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):15360
                                                                                                                                                                                                                                                        Entropy (8bit):5.451865349855574
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:384:KfwogDHER1wuiDSyoGTgDZOviNgEPrLg:ugDHELwuiDScTgDwi+EP
                                                                                                                                                                                                                                                        MD5:1FA5E257A85D16E916E9C22984412871
                                                                                                                                                                                                                                                        SHA1:1AC8EE98AD0A715A1B40AD25D2E8007CDC19871F
                                                                                                                                                                                                                                                        SHA-256:D87A9B7CAD4C451D916B399B19298DC46AAACC085833C0793092641C00334B8E
                                                                                                                                                                                                                                                        SHA-512:E4205355B647C6E28B7E4722328F51DC2EB3A109E9D9B90F7C53D7A80A5A4B10E40ABDDAB1BA151E73EF3EB56941F843535663F42DCE264830E6E17BB659EADF
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ..... ..........P.....................................................`..........................................8......`9..d....`.......P..X............p..(....1...............................1..8............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..(....p.......:..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_RIPEMD160.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):13824
                                                                                                                                                                                                                                                        Entropy (8bit):5.104245335186531
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:192:3F/1n7Guqaj0kt7/Ev9kt0Qwac6QzD8iD0QocqgI4G0S:nGXkd/EvGt9wacNDvAgI4v
                                                                                                                                                                                                                                                        MD5:FAD578A026F280C1AE6F787B1FA30129
                                                                                                                                                                                                                                                        SHA1:9A3E93818A104314E172A304C3D117B6A66BEB55
                                                                                                                                                                                                                                                        SHA-256:74A1FF0801F4704158684267CD8E123F83FB6334FE522C1890AC4A0926F80AB1
                                                                                                                                                                                                                                                        SHA-512:ACF8F5B382F3B4C07386505BBDCAF625D13BCC10AA93ED641833E3548261B0AD1063E2F59BE2FCD2AFAF3D315CB3FC5EB629CEFC168B33CFD65A3A6F1120F7FF
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ......... ......P.....................................................`..........................................9.......:..d....`.......P...............p..(...@3..............................`3..8............0...............................text...H........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata.......P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_SHA1.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):17920
                                                                                                                                                                                                                                                        Entropy (8bit):5.671305741258107
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:384:APHoDUntQj0sKhDOJ+0QPSfu6rofDjiZzgE+kbwb:VUOYsKNO466DjoUE+
                                                                                                                                                                                                                                                        MD5:556E6D0E5F8E4DA74C2780481105D543
                                                                                                                                                                                                                                                        SHA1:7A49CDEF738E9FE9CD6CD62B0F74EAD1A1774A33
                                                                                                                                                                                                                                                        SHA-256:247B0885CF83375211861F37B6DD1376AED5131D621EE0137A60FE7910E40F8B
                                                                                                                                                                                                                                                        SHA-512:28FA0CE6BDBCC5E95B80AADC284C12658EF0C2BE63421AF5627776A55050EE0EA0345E30A15B744FC2B2F5B1B1BBB61E4881F27F6E3E863EBAAEED1073F4CDA1
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." .....*..........P.....................................................`..........................................H......hI..d....p.......`..X...............(....A...............................A..8............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data........P.......<..............@....pdata..X....`.......>..............@..@.rsrc........p.......B..............@..@.reloc..(............D..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_SHA224.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):21504
                                                                                                                                                                                                                                                        Entropy (8bit):5.878701941774916
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:384:EJWo4IRCGHX1KXqHGcvYHp5RYcARQOj4MSTjqgPmJD1OhgkxEv:EcIRnHX1P/YtswvaD1Rk
                                                                                                                                                                                                                                                        MD5:2F2655A7BBFE08D43013EDDA27E77904
                                                                                                                                                                                                                                                        SHA1:33D51B6C423E094BE3E34E5621E175329A0C0914
                                                                                                                                                                                                                                                        SHA-256:C734ABBD95EC120CB315C43021C0E1EB1BF2295AF9F1C24587334C3FCE4A5BE1
                                                                                                                                                                                                                                                        SHA-512:8AF99ACC969B0E560022F75A0CDCAA85D0BDEADADEACD59DD0C4500F94A5843EA0D4107789C1A613181B1F4E5252134A485EF6B1D9D83CDB5676C5FEE4D49B90
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...S..f.........." .....6... ......P.....................................................`.........................................@Z......([..d............p..................(....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..x....P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..(............R..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_SHA256.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):21504
                                                                                                                                                                                                                                                        Entropy (8bit):5.881781476285865
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:384:EJWo4IRCGHXfKXqHGcvYHp5RYcARQOj4MSTjqgPmJD12gkxEv:EcIRnHXfP/YtswvaD1zk
                                                                                                                                                                                                                                                        MD5:CDE035B8AB3D046B1CE37EEE7EE91FA0
                                                                                                                                                                                                                                                        SHA1:4298B62ED67C8D4F731D1B33E68D7DC9A58487FF
                                                                                                                                                                                                                                                        SHA-256:16BEA322D994A553B293A724B57293D57DA62BC7EAF41F287956B306C13FD972
                                                                                                                                                                                                                                                        SHA-512:C44FDEE5A210459CE4557351E56B2D357FD4937F8EC8EACEAB842FEE29761F66C2262FCBAAC837F39C859C67FA0E23D13E0F60B3AE59BE29EB9D8ABAB0A572BB
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...S..f.........." .....6... ......P.....................................................`.........................................@Z......([..d............p..................(....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..x....P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..(............R..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_SHA384.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):26624
                                                                                                                                                                                                                                                        Entropy (8bit):5.837887867708438
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:768:e839Cc4itui0gel9soFdkO66MlPGXmXcyYDTzks:Ns4u/FZ6nPxMLDvk
                                                                                                                                                                                                                                                        MD5:999D431197D7E06A30E0810F1F910B9A
                                                                                                                                                                                                                                                        SHA1:9BFF781221BCFFD8E55485A08627EC2A37363C96
                                                                                                                                                                                                                                                        SHA-256:AB242B9C9FB662C6F7CB57F7648F33983D6FA3BB0683C5D4329EC2CC51E8C875
                                                                                                                                                                                                                                                        SHA-512:A5DD92DD471ADB44EEFE5919EF9CA3978724E21174DF5B3A9C1F0AB462F928E5A46A460D02417DB7522F5DE3BFEED5EEE6B1EAFAF3E621722E85E72675F7096F
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...T..f.........." .....H..."......P.....................................................`..........................................k.......l..d...............................(...pd...............................d..8............`...............................text....F.......H.................. ..`.rdata.......`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..(............f..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_SHA512.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):26624
                                                                                                                                                                                                                                                        Entropy (8bit):5.895310340516013
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:768:lcX9Nf4ttui0gel9soFdkO66MlPGXmXc/vDTOvk:a38u/FZ6nPxM3DAk
                                                                                                                                                                                                                                                        MD5:0931ABBF3AED459B1A2138B551B1D3BB
                                                                                                                                                                                                                                                        SHA1:9EC0296DDAF574A89766A2EC035FC30073863AB0
                                                                                                                                                                                                                                                        SHA-256:1729A0DC6B80CB7A3C07372B98B10D3C6C613EA645240878E1FDE6A992FA06F1
                                                                                                                                                                                                                                                        SHA-512:9F970BB4D10B94F525DDDDE307C7DA5E672BBFB3A3866A34B89B56ADA99476724FD690A4396857182749294F67F36DB471A048789FB715D2A7DAF46917FC1947
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...T..f.........." .....H..."......P.....................................................`.........................................@l......(m..d...............................(....d...............................e..8............`...............................text...hG.......H.................. ..`.rdata..x....`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..(............f..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_ghash_clmul.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):12800
                                                                                                                                                                                                                                                        Entropy (8bit):4.967737129255606
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:192:dMpWt/1nCuqaL0kt7TsEx2fiTgDZqGF0T7cqgkLgJ:k/k1Ts64DDJyBgkLg
                                                                                                                                                                                                                                                        MD5:5F057A380BACBA4EF59C0611549C0E02
                                                                                                                                                                                                                                                        SHA1:4B758D18372D71F0AA38075F073722A55B897F71
                                                                                                                                                                                                                                                        SHA-256:BCB14DAC6C87C24269D3E60C46B49EFFB1360F714C353318F5BBAA48C79EC290
                                                                                                                                                                                                                                                        SHA-512:E1C99E224745B86EE55822C1DBCB4555A11EC31B72D87B46514917EB61E0258A1C6D38C4F592969C17EB4F0F74DA04BCECA31CF1622720E95F0F20E9631792E8
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...V..f.........." ................P.....................................................`.........................................P8.......8..d....`.......P...............p..(....1...............................1..8............0...............................text............................... ..`.rdata..2....0......................@..@.data...H....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..(....p.......0..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_ghash_portable.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):13312
                                                                                                                                                                                                                                                        Entropy (8bit):5.007867576025166
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:192:bMt/1nCuqaL0ktPH0T7fwtF4zDn2rGacqgRGd:1/kpU3Yv4zDXqgRGd
                                                                                                                                                                                                                                                        MD5:49BCA1B7DF076D1A550EE1B7ED3BD997
                                                                                                                                                                                                                                                        SHA1:47609C7102F5B1BCA16C6BAD4AE22CE0B8AEE9E9
                                                                                                                                                                                                                                                        SHA-256:49E15461DCB76690139E71E9359F7FCF92269DCCA78E3BFE9ACB90C6271080B2
                                                                                                                                                                                                                                                        SHA-512:8574D7FA133B72A4A8D1D7D9FDB61053BC88C2D238B7AC7D519BE19972B658C44EA1DE433885E3206927C75DD5D1028F74999E048AB73189585B87630F865466
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...V..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..(....p.......2..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_keccak.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):15872
                                                                                                                                                                                                                                                        Entropy (8bit):5.226023387740053
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:384:rfRKTN+HLjRskTdf4WazSTkwjEvuY2bylHDiYIgovg:mcHfRl5pauoSjy5DiE
                                                                                                                                                                                                                                                        MD5:CB5CFDD4241060E99118DEEC6C931CCC
                                                                                                                                                                                                                                                        SHA1:1E7FED96CF26C9F4730A4621CA9D18CECE3E0BCE
                                                                                                                                                                                                                                                        SHA-256:A8F809B6A417AF99B75EEEEA3ECD16BDA153CBDA4FFAB6E35CE1E8C884D899C4
                                                                                                                                                                                                                                                        SHA-512:8A89E3563C14B81353D251F9F019D8CBF07CB98F78452B8522413C7478A0D77B9ABF2134E4438145D6363CDA39721D2BAE8AD13D1CDACCBB5026619D95F931CF
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...U..f.........." ..... ... ......P.....................................................`..........................................9.......9..d....`.......P..X............p..(...p2...............................2..8............0...............................text............ .................. ..`.rdata..@....0.......$..............@..@.data........@.......4..............@....pdata..X....P.......6..............@..@.rsrc........`.......:..............@..@.reloc..(....p.......<..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Hash\_poly1305.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):14848
                                                                                                                                                                                                                                                        Entropy (8bit):5.262055670423592
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:192:C/ZN2eq/b04PAHH41F6fnVS0sVn+5CA5Z1cD66WGcqgFjLg:vI4IHHaQfSVnCZyDImgFjLg
                                                                                                                                                                                                                                                        MD5:18D2D96980802189B23893820714DA90
                                                                                                                                                                                                                                                        SHA1:5DEE494D25EB79038CBC2803163E2EF69E68274C
                                                                                                                                                                                                                                                        SHA-256:C2FD98C677436260ACB9147766258CB99780A007114AED37C87893DF1CF1A717
                                                                                                                                                                                                                                                        SHA-512:0317B65D8F292332C5457A6B15A77548BE5B2705F34BB8F4415046E3E778580ABD17B233E6CC2755C991247E0E65B27B5634465646715657B246483817CACEB7
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...V..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..|............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......."..............@..@.data........@.......0..............@....pdata..|....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..(....p.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Math\_modexp.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):36352
                                                                                                                                                                                                                                                        Entropy (8bit):5.913843738203007
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:384:dspbXtHQY4ubrttQza9CHnZXQsnecAlOF0qZLAXxQI3Sya6XPpMg3Yx8MnDcCPSq:7Y44UagH6cAFCLUSYpMg3YDzPo5kG9G
                                                                                                                                                                                                                                                        MD5:EF472BA63FD22922CA704B1E7B95A29E
                                                                                                                                                                                                                                                        SHA1:700B68E7EF95514D5E94D3C6B10884E1E187ACD8
                                                                                                                                                                                                                                                        SHA-256:66EEF4E6E0CEEEF2C23A758BFBEDAE7C16282FC93D0A56ACAFC40E871AC3F01C
                                                                                                                                                                                                                                                        SHA-512:DC2060531C4153C43ABF30843BCB5F8FA082345CA1BB57F9AC8695EDDB28FF9FDA8132B6B6C67260F779D95FCADCAE2811091BCA300AB1E041FAE6CC7B50ABD8
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...|...5...}...~...U...,...u...,...v...,...}.......|............._.............Rich~...................PE..d...^..f.........." .....`...0......`.....................................................`..........................................~..|...L...d...............<...............(....q...............................q..8............p..(............................text...X^.......`.................. ..`.rdata.......p.......d..............@..@.data................x..............@....pdata..<...........................@..@.rsrc...............................@..@.reloc..(...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Protocol\_scrypt.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):12288
                                                                                                                                                                                                                                                        Entropy (8bit):4.735350805948923
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:192:rhsC3eqv6b0q3OQ3rHu5bc64OhD2I/p3cqgONLg:r/Hq3jHuY64OhDJJgONLg
                                                                                                                                                                                                                                                        MD5:3B1CE70B0193B02C437678F13A335932
                                                                                                                                                                                                                                                        SHA1:063BFD5A32441ED883409AAD17285CE405977D1F
                                                                                                                                                                                                                                                        SHA-256:EB2950B6A2185E87C5318B55132DFE5774A5A579259AB50A7935A7FB143EA7B1
                                                                                                                                                                                                                                                        SHA-512:0E02187F17DFCFD323F2F0E62FBFE35F326DCF9F119FC8B15066AFAEEE4EB7078184BC85D571B555E9E67A2DD909EC12D8A67E3D075E9B1283813EF274E05C0D
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d...Z..f.........." ................P.....................................................`..........................................8..d....8..d....`.......P..4............p..(....1...............................1..8............0...............................text...H........................... ..`.rdata..0....0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..(....p......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\PublicKey\_curve25519.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):22528
                                                                                                                                                                                                                                                        Entropy (8bit):5.705606408072877
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:384:19BcRxBmau38CYIl9bhgIW0mvufueNr359/tjGGDEFSegqrA:NcRy38J+9dmvufFtaGDV
                                                                                                                                                                                                                                                        MD5:FF33C306434DEC51D39C7BF1663E25DA
                                                                                                                                                                                                                                                        SHA1:665FCF47501F1481534597C1EAC2A52886EF0526
                                                                                                                                                                                                                                                        SHA-256:D0E3B6A2D0E073B2D9F0FCDB051727007943A17A4CA966D75EBA37BECDBA6152
                                                                                                                                                                                                                                                        SHA-512:66A909DC9C3B7BD4050AA507CD89B0B3A661C85D33C881522EC9568744953B698722C1CBFF093F9CBCD6119BD527FECAB05A67F2E32EC479BE47AFFA4377362C
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...\..f.........." .....6...$......P.....................................................`.........................................`Y......`Z..d............p..................(....R..............................0R..8............P...............................text...(5.......6.................. ..`.rdata.......P.......:..............@..@.data........`.......J..............@....pdata.......p.......P..............@..@.rsrc................T..............@..@.reloc..(............V..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\PublicKey\_curve448.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):70656
                                                                                                                                                                                                                                                        Entropy (8bit):6.0189903352673655
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:1536:Jfju4GgRMgWWnEDZiECgd/iwOXUQdbhov0Clb8Cx4hpK8ithLFIDullRPwDHxXOa:pXRMgWiEDZiECgd/iwOXUQdbhov0ClbU
                                                                                                                                                                                                                                                        MD5:F267BF4256F4105DAD0D3E59023011ED
                                                                                                                                                                                                                                                        SHA1:9BC6CA0F375CE49D5787C909D290C07302F58DA6
                                                                                                                                                                                                                                                        SHA-256:1DDE8BE64164FF96B2BAB88291042EB39197D118422BEE56EB2846E7A2D2F010
                                                                                                                                                                                                                                                        SHA-512:A335AF4DBF1658556ED5DC13EE741419446F7DAEC6BD2688B626A803FA5DD76463D6367C224E0B79B17193735E2C74BA417C26822DAEEF05AC3BAB1588E2DE83
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...|...5...}...~...U...,...u...,...v...,...}.......|............._.............Rich~...................PE..d...\..f.........." .........8......`........................................P............`.............................................0.......d....0....... ..$............@..(.......................................8............................................text...8........................... ..`.rdata..............................@..@.data...............................@....pdata..$.... ......................@..@.rsrc........0......................@..@.reloc..(....@......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\PublicKey\_ec_ws.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):770560
                                                                                                                                                                                                                                                        Entropy (8bit):7.613224993327352
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:12288:XtIrHoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h:XtIrHoxJFf1p34hcrn5Go9yQO6
                                                                                                                                                                                                                                                        MD5:1EFD7F7CB1C277416011DE6F09C355AF
                                                                                                                                                                                                                                                        SHA1:C0F97652AC2703C325AB9F20826A6F84C63532F2
                                                                                                                                                                                                                                                        SHA-256:AB45FA80A68DB1635D41DC1A4AAD980E6716DAC8C1778CB5F30CDB013B7DF6E6
                                                                                                                                                                                                                                                        SHA-512:2EC4B88A1957733043BBD63CEAA6F5643D446DB607B3267FAD1EC611E6B0AF697056598AAC2AE5D44AB2B9396811D183C32BCE5A0FF34E583193A417D1C5226B
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s.. .. .. ... .. ..!.. ..!.. .. .. ..!.. ..!.. ..!.. \..!.. \..!.. \.r .. \..!.. Rich.. ................PE..d...[..f.........." ................`.....................................................`.............................................h.......d...............................0......................................8...............(............................text............................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\PublicKey\_ed25519.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):26112
                                                                                                                                                                                                                                                        Entropy (8bit):5.8551858881598795
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:384:BczadRwoF2MZ81n0XTyMCYIl9bhgIW0mv8aeadRcwRwftjGLD2pRQNgQQ77k:2udRf2MuMJ+9dmv8aea34taLDcfQ
                                                                                                                                                                                                                                                        MD5:C5FB377F736ED731B5578F57BB765F7A
                                                                                                                                                                                                                                                        SHA1:5BA51E11F4DE1CAEDEBA0F7D4D10EC62EC109E01
                                                                                                                                                                                                                                                        SHA-256:32073DF3D5C85ABCE7D370D6E341EF163A8350F6A9EDC775C39A23856CCFDD53
                                                                                                                                                                                                                                                        SHA-512:D361BCDAF2C700D5A4AC956D96E00961432C05A1B692FC870DB53A90F233A6D24AA0C3BE99E40BD8E5B7C6C1B2BCDCDCFC545292EF321486FFC71C5EA7203E6A
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...]..f.........." .....B...&......P.....................................................`..........................................i..0....k..d...............................(... b..............................@b..8............`...............................text....A.......B.................. ..`.rdata..P....`.......F..............@..@.data........p.......V..............@....pdata...............^..............@..@.rsrc................b..............@..@.reloc..(............d..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\PublicKey\_ed448.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):84992
                                                                                                                                                                                                                                                        Entropy (8bit):6.064677498000638
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:1536:BrYNvxcZeLrIeNs2qkTwe57DsuP45PqAqVDK9agdUiwOXyQdDrov0slb8gx4TBKW:Br4vxcZeLrIeN1TvHsuP45yAqVDK9ag3
                                                                                                                                                                                                                                                        MD5:8A0C0AA820E98E83AC9B665A9FD19EAF
                                                                                                                                                                                                                                                        SHA1:6BF5A14E94D81A55A164339F60927D5BF1BAD5C4
                                                                                                                                                                                                                                                        SHA-256:4EE3D122DCFFE78E6E7E76EE04C38D3DC6A066E522EE9F7AF34A09649A3628B1
                                                                                                                                                                                                                                                        SHA-512:52496AE7439458DEDB58A65DF9FFDCC3A7F31FC36FE7202FB43570F9BB03ABC0565F5EF32E5E6C048ED3EBC33018C19712E58FF43806119B2FB5918612299E7E
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...|...5...}...~...U...,...u...,...v...,...}.......|............._.............Rich~...................PE..d...^..f.........." .........8......`.....................................................`..........................................C..h...HE..d....p.......`..l...............(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......4..............@....pdata..l....`.......>..............@..@.rsrc........p.......H..............@..@.reloc..(............J..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Util\_cpuid_c.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):10240
                                                                                                                                                                                                                                                        Entropy (8bit):4.675380950473425
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:96:frQRpBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSztllIDpqf4AZaRcX6gnO:Qddz2KTnThIz0qfteRIDgRWcqgnCWt
                                                                                                                                                                                                                                                        MD5:44B930B89CE905DB4716A548C3DB8DEE
                                                                                                                                                                                                                                                        SHA1:948CBFF12A243C8D17A7ACD3C632EE232DF0F0ED
                                                                                                                                                                                                                                                        SHA-256:921C2D55179C0968535B20E9FD7AF55AD29F4CE4CF87A90FE258C257E2673AA5
                                                                                                                                                                                                                                                        SHA-512:79DF755BE8B01D576557A4CB3F3200E5EE1EDE21809047ABB9FF8D578C535AC1EA0277EDA97109839A7607AF043019F2C297E767441C7E11F81FDC87FD1B6EFC
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...X..f.........." ................P........................................p............`.........................................@'..|....'..P....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\Crypto\Util\_strxor.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):10240
                                                                                                                                                                                                                                                        Entropy (8bit):4.625428549874022
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:96:flipBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSzteXuDVZqYNIfcX6gHCWx:Cddz2KTnThIz0qfteR5DVwYkcqgHCWt
                                                                                                                                                                                                                                                        MD5:F24F9356A6BDD29B9EF67509A8BC3A96
                                                                                                                                                                                                                                                        SHA1:A26946E938304B4E993872C6721EB8CC1DCBE43B
                                                                                                                                                                                                                                                        SHA-256:034BB8EFE3068763D32C404C178BD88099192C707A36F5351F7FDB63249C7F81
                                                                                                                                                                                                                                                        SHA-512:C4D3F92D7558BE1A714388C72F5992165DD7A9E1B4FA83B882536030542D93FDAD9148C981F76FFF7868192B301AC9256EDB8C3D5CE5A1A2ACAC183F96C1028B
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...Z..f.........." ................P........................................p............`......................................... '..t....'..P....P.......@...............`..(....!...............................!..8............ ...............................text...h........................... ..`.rdata..`.... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\VCRUNTIME140.dll

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):120400
                                                                                                                                                                                                                                                        Entropy (8bit):6.6017475353076716
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
                                                                                                                                                                                                                                                        MD5:862F820C3251E4CA6FC0AC00E4092239
                                                                                                                                                                                                                                                        SHA1:EF96D84B253041B090C243594F90938E9A487A9A
                                                                                                                                                                                                                                                        SHA-256:36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153
                                                                                                                                                                                                                                                        SHA-512:2F8A0F11BCCC3A8CB99637DEEDA0158240DF0885A230F38BB7F21257C659F05646C6B61E993F87E0877F6BA06B347DDD1FC45D5C44BC4E309EF75ED882B82E4E
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\=..\...\...\..S$...\...$...\...\..5\...\...\.....\.....\.....\.....\......\.....\..Rich.\..........PE..d.....x.........." ...).$...d............................................................`A........................................0u..4...d}..........................PP...........^..p............................\..@............@...............................text............................... ..`fothk........0...................... ..`.rdata...C...@...D...(..............@..@.data................l..............@....pdata...............p..............@..@_RDATA...............|..............@..@.rsrc................~..............@..@.reloc..............................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\VCRUNTIME140_1.dll

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):49744
                                                                                                                                                                                                                                                        Entropy (8bit):6.701724666218339
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
                                                                                                                                                                                                                                                        MD5:68156F41AE9A04D89BB6625A5CD222D4
                                                                                                                                                                                                                                                        SHA1:3BE29D5C53808186EBA3A024BE377EE6F267C983
                                                                                                                                                                                                                                                        SHA-256:82A2F9AE1E6146AE3CB0F4BC5A62B7227E0384209D9B1AEF86BBCC105912F7CD
                                                                                                                                                                                                                                                        SHA-512:F7BF8AD7CD8B450050310952C56F6A20B378A972C822CCC253EF3D7381B56FFB3CA6CE3323BEA9872674ED1C02017F78AB31E9EB9927FC6B3CBA957C247E5D57
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.{...{...{...0...y.......y...r.H.p...{...H.......|.......`.......~.......z.....$.z.......z...Rich{...........PE..d...l0.?.........." ...).<...8.......@...............................................b....`A........................................pm.......m..x....................r..PP......D....c..p...........................`b..@............P..`............................text....;.......<.................. ..`.rdata.."#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\_asyncio.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):70928
                                                                                                                                                                                                                                                        Entropy (8bit):6.242470629630265
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:768:FCIB0WWuqkJS86D6rznO6uqM+lY5ZkesIcydIJvn/5YiSyvT2ETh:FCY0WStDwnOLYY5ZkeddIJvnx7Sy75h
                                                                                                                                                                                                                                                        MD5:80083B99812171FEA682B1CF38026816
                                                                                                                                                                                                                                                        SHA1:365FB5B0C652923875E1C7720F0D76A495B0E221
                                                                                                                                                                                                                                                        SHA-256:DBEAE7CB6F256998F9D8DE79D08C74D716D819EB4473B2725DBE2D53BA88000A
                                                                                                                                                                                                                                                        SHA-512:33419B9E18E0099DF37D22E33DEBF15D57F4248346B17423F2B55C8DA7CBE62C19AA0BB5740CFAAC9BC6625B81C54367C0C476EAECE71727439686567F0B1234
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Z...........%.....................................................K...................I...........Rich...................PE..d......g.........." ...).d................................................... ............`.........................................`...P.......d......................../.............T...............................@...............(............................text...)b.......d.................. ..`.rdata...O.......P...h..............@..@.data...`...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\_bz2.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):84240
                                                                                                                                                                                                                                                        Entropy (8bit):6.607563436050078
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:1536:Kdrz7l1EVLsSuvX3dUK4MLgqK7YEog8y5sV8lIJLVy7SyFB:urzcuvXvrEo7y6V8lIJLVyB
                                                                                                                                                                                                                                                        MD5:CB8C06C8FA9E61E4AC5F22EEBF7F1D00
                                                                                                                                                                                                                                                        SHA1:D8E0DFC8127749947B09F17C8848166BAC659F0D
                                                                                                                                                                                                                                                        SHA-256:FC3B481684B926350057E263622A2A5335B149A0498A8D65C4F37E39DD90B640
                                                                                                                                                                                                                                                        SHA-512:E6DA642B7200BFB78F939F7D8148581259BAA9A5EDDA282C621D14BA88083A9B9BD3D17B701E9CDE77AD1133C39BD93FC9D955BB620546BB4FCF45C68F1EC7D6
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e...!m..!m..!m..(.o.+m..1...#m..1..."m..1...%m..1...)m..1...,m..i..."m..j...#m..!m..|m..i...)m..i... m..i... m..i... m..Rich!m..........PE..d.....g.........." ...).....\......0........................................P......7[....`.............................................H...(........0....... .. ......../...@..........T...........................`...@...............x............................text............................... ..`.rdata...=.......>..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\_cffi_backend.cp313-win_amd64.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):179200
                                                                                                                                                                                                                                                        Entropy (8bit):6.189919896183334
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:3072:X3LjFuaTzDGA3GrJwUdoSPhpRv9JUizQWS7LkSTLkKWgFIPXD0:X3QaT3GA3NSPhDsizTikSTLLWgF0z0
                                                                                                                                                                                                                                                        MD5:5CBA92E7C00D09A55F5CBADC8D16CD26
                                                                                                                                                                                                                                                        SHA1:0300C6B62CD9DB98562FDD3DE32096AB194DA4C8
                                                                                                                                                                                                                                                        SHA-256:0E3D149B91FC7DC3367AB94620A5E13AF6E419F423B31D4800C381468CB8AD85
                                                                                                                                                                                                                                                        SHA-512:7AB432C8774A10F04DDD061B57D07EBA96481B5BB8C663C6ADE500D224C6061BC15D17C74DA20A7C3CEC8BBF6453404D553EBAB22D37D67F9B163D7A15CF1DED
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......i..#-p.p-p.p-p.p$..p!p.p=.q/p.p=.zp)p.p=.q)p.p=.q%p.p=.q!p.pf..q)p.p9.q.p.p-p.p.p.pe..q)p.p$..p,p.pe..q,p.pe.xp,p.pe..q,p.pRich-p.p........................PE..d..._..f.........." ...).....B......@........................................0............`..........................................h..l....i..................T............ ......0O...............................M..@............................................text............................... ..`.rdata..............................@..@.data....].......0...n..............@....pdata..T...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\_ctypes.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):131344
                                                                                                                                                                                                                                                        Entropy (8bit):6.311142284249784
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:3072:3RF024DWkT/DKGkXY402iXnVJf/FO50XnekZ39gPhvEQZIJyPArm:j0nHT/DKFXZorf/FO50uW3SEQt
                                                                                                                                                                                                                                                        MD5:A55E57D7594303C89B5F7A1D1D6F2B67
                                                                                                                                                                                                                                                        SHA1:904A9304A07716497CF3E4EAAFD82715874C94F1
                                                                                                                                                                                                                                                        SHA-256:F63C6C7E71C342084D8F1A108786CA6975A52CEFEF8BE32CC2589E6E2FE060C8
                                                                                                                                                                                                                                                        SHA-512:FFA61AD2A408A831B5D86B201814256C172E764C9C1DBE0BD81A2E204E9E8117C66F5DFA56BB7D74275D23154C0ED8E10D4AE8A0D0564434E9761D754F1997FC
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h~..............q...............................................q.......q......!u.............................................Rich....................PE..d.....g.........." ...).............h....................................... .......Z....`.........................................P.................................../...........=..T............................;..@............0...............................text............................... ..`.rdata...y...0...z..................@..@.data....$....... ..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\_decimal.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):277776
                                                                                                                                                                                                                                                        Entropy (8bit):6.5855511991551
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:6144:x9iD78EIq4x4OA5bZZ0KDgQcI79qWM53pLW1AFR8E4wXw76TPlpV77777VMvyk:xwDGqr5b8EgQ5+w6k
                                                                                                                                                                                                                                                        MD5:F3377F3DE29579140E2BBAEEFD334D4F
                                                                                                                                                                                                                                                        SHA1:B3076C564DBDFD4CA1B7CC76F36448B0088E2341
                                                                                                                                                                                                                                                        SHA-256:B715D1C18E9A9C1531F21C02003B4C6726742D1A2441A1893BC3D79D7BB50E91
                                                                                                                                                                                                                                                        SHA-512:34D9591590BBA20613691A5287EF329E5927A58127CE399088B4D68A178E3AF67159A8FC55B4FCDCB08AE094753B20DEC2AC3F0B3011481E4ED6F37445CECDD5
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j2U..\...\...\..s....\..]...\.._...\..X...\..Y...\...]...\..s]...\...].z.\..._...\...Q...\...\...\.......\...^...\.Rich..\.........................PE..d......g.........." ...).....Z...............................................P......W.....`.................................................L........0..........t+......./...@..........T...............................@............... ............................text.............................. ..`.rdata..\...........................@..@.data...8'......."..................@....pdata..t+.......,..................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\_hashlib.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):64272
                                                                                                                                                                                                                                                        Entropy (8bit):6.220967684620152
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:768:eNJI0DWiflFwY9X3Th1JnptE462TxNvdbj4dIJvI75YiSyvE62Em:2LDxflFwY9XDhPfVNv+dIJvIF7Syc6c
                                                                                                                                                                                                                                                        MD5:32D76C9ABD65A5D2671AEEDE189BC290
                                                                                                                                                                                                                                                        SHA1:0D4440C9652B92B40BB92C20F3474F14E34F8D62
                                                                                                                                                                                                                                                        SHA-256:838D5C8B7C3212C8429BAF612623ABBBC20A9023EEC41E34E5461B76A285B86C
                                                                                                                                                                                                                                                        SHA-512:49DC391F4E63F4FF7D65D6FD837332745CC114A334FD61A7B6AA6F710B235339964B855422233FAC4510CCB9A6959896EFE880AB24A56261F78B2A0FD5860CD9
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W.A.6...6...6...N%..6.......6.......6.......6.......6.......6...N...6.......6...6..26.......6.......6....I..6.......6..Rich.6..........PE..d......g.........." ...).P...~.......=..............................................!.....`.........................................p...P................................/......X....l..T............................k..@............`...............................text....N.......P.................. ..`.rdata...M...`...N...T..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\_lzma.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):157968
                                                                                                                                                                                                                                                        Entropy (8bit):6.854644275249963
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:3072:KbbS4R/G4Z8r7NjwJTSUqCRY4By7znfB9mNowgn0lCelIJ012+j:KbR/8oWeBi5YOwflCe8o
                                                                                                                                                                                                                                                        MD5:1BA022D42024A655CF289544AE461FB8
                                                                                                                                                                                                                                                        SHA1:9772A31083223ECF66751FF3851D2E3303A0764C
                                                                                                                                                                                                                                                        SHA-256:D080EABD015A3569813A220FD4EA74DFF34ED2A8519A10473EB37E22B1118A06
                                                                                                                                                                                                                                                        SHA-512:2B888A2D7467E29968C6BB65AF40D4B5E80722FFDDA760AD74C912F3A2F315D402F3C099FDE82F00F41DE6C9FAAEDB23A643337EB8821E594C567506E3464C62
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7...V.,.V.,.V.,...,.V.,..-.V.,..-.V.,..-.V.,..-.V.,..-.V.,...-.V.,.V.,.V.,..-.V.,..-.V.,..u,.V.,..-.V.,Rich.V.,................PE..d......g.........." ...).`...........1.......................................p.......P....`.............................................L.......x....P.......0.......:.../...`..4....|..T...........................P{..@............p...............................text...^^.......`.................. ..`.rdata.......p.......d..............@..@.data........ ......................@....pdata.......0......................@..@.rsrc........P......................@..@.reloc..4....`.......8..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\_multiprocessing.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):35600
                                                                                                                                                                                                                                                        Entropy (8bit):6.416657776501014
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:768:6wehui7ZmQW/3OUDxEiNIJntJ5YiSyvSJz2Ec:whuilG+UDxEiNIJntX7Sy+zO
                                                                                                                                                                                                                                                        MD5:705AC24F30DC9487DC709307D15108ED
                                                                                                                                                                                                                                                        SHA1:E9E6BA24AF9947D8995392145ADF62CAC86BA5D8
                                                                                                                                                                                                                                                        SHA-256:59134B754C6ACA9449E2801E9E7ED55279C4F1ED58FE7A7A9F971C84E8A32A6C
                                                                                                                                                                                                                                                        SHA-512:F5318EBB91F059F0721D75D576B39C7033D566E39513BAD8E7E42CCC922124A5205010415001EE386495F645238E2FF981A8B859F0890DC3DA4363EB978FDBA7
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.Y)v.7zv.7zv.7z..zt.7zf,6{t.7zf,4{u.7zf,3{~.7zf,2{{.7z>-6{t.7zv.6z..7z=.6{s.7z>-:{t.7z>-7{w.7z>-.zw.7z>-5{w.7zRichv.7z........PE..d......g.........." ...). ...>......@...............................................%.....`......................................... E..`....E..x............p.......\.../...........4..T............................3..@............0...............................text............ .................. ..`.rdata..6 ...0..."...$..............@..@.data...p....`.......F..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\_overlapped.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):55568
                                                                                                                                                                                                                                                        Entropy (8bit):6.3313243577146485
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:1536:+kMm7HdG/l5fW3UguCE+eRIJWtd7SyJds:+wIQUFCEbRIJWtd6
                                                                                                                                                                                                                                                        MD5:A72527454DD6DA346DDB221FC729E3D4
                                                                                                                                                                                                                                                        SHA1:0276387E3E0492A0822DB4EABE23DB8C25EF6E6F
                                                                                                                                                                                                                                                        SHA-256:404353D7B867749FA2893033BD1EBF2E3F75322D4015725D697CFA5E80EC9D0F
                                                                                                                                                                                                                                                        SHA-512:FEFB543D20520F86B63E599A56E2166599DFA117EDB2BEB5E73FC8B43790543702C280A05CCFD9597C0B483F637038283DD48EF8C88B4EA6BAC411EC0043B10A
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.{X/.(X/.(X/.(QW_(\/.(H..)Z/.(H..)[/.(H..)P/.(H..)T/.(...)Z/.(X/.(//.(.W.)]/.(.W.)Y/.(...)Y/.(...)Y/.(..3(Y/.(...)Y/.(RichX/.(........................PE..d.....g.........." ...).L...`......@................................................}....`.............................................X................................/......(....f..T............................e..@............`...............................text....J.......L.................. ..`.rdata...8...`...:...P..............@..@.data...@...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..(...........................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\_queue.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):33552
                                                                                                                                                                                                                                                        Entropy (8bit):6.446391764486538
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:384:7GpPCRjqMu/AoS6rf7sif0NHQibZIJ9UoOHQIYiSy1pCQ5xX1rSJIVE8E9VF0Nyf:fkTM6rg9aeZIJ9Uok5YiSyvTo2Et
                                                                                                                                                                                                                                                        MD5:1C03CAA59B5E4A7FB9B998D8C1DA165A
                                                                                                                                                                                                                                                        SHA1:8A318F80A705C64076E22913C2206D9247D30CD7
                                                                                                                                                                                                                                                        SHA-256:B9CF502DADCB124F693BF69ECD7077971E37174104DBDA563022D74961A67E1E
                                                                                                                                                                                                                                                        SHA-512:783ECDA7A155DFC96A718D5A130FB901BBECBED05537434E779135CBA88233DD990D86ECA2F55A852C9BFB975074F7C44D8A3E4558D7C2060F411CE30B6A915F
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T...........-.........................................................................A...........Rich...................PE..d.....g.........." ...).....:.......................................................r....`.........................................PD..L....D..d....p.......`..l....T.../..........@4..T............................3..@............0...............................text............................... ..`.rdata..2....0....... ..............@..@.data........P.......>..............@....pdata..l....`.......D..............@..@.rsrc........p.......H..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\_socket.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):83728
                                                                                                                                                                                                                                                        Entropy (8bit):6.331814573029388
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:1536:XuV3gvWHQdMq3ORC/OypTXQlyJ+9+nzEYwsBI6tzOKuZIJywJ7Sy21:XuVQvcQTSypTXQlyJs+nzEYJI6QlZIJY
                                                                                                                                                                                                                                                        MD5:FE896371430BD9551717EF12A3E7E818
                                                                                                                                                                                                                                                        SHA1:E2A7716E9CE840E53E8FC79D50A77F40B353C954
                                                                                                                                                                                                                                                        SHA-256:35246B04C6C7001CA448554246445A845CE116814A29B18B617EA38752E4659B
                                                                                                                                                                                                                                                        SHA-512:67ECD9A07DF0A07EDD010F7E3732F3D829F482D67869D6BCE0C9A61C24C0FDC5FF4F4E4780B9211062A6371945121D8883BA2E9E2CF8EB07B628547312DFE4C9
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ll}.ll}.ll}...}.ll}..m|.ll}..o|.ll}..h|.ll}..i|.ll}..m|.ll}.lm}.ll}..m|.ll}..a|.ll}..l|.ll}..}.ll}..n|.ll}Rich.ll}........PE..d.....g.........." ...).x.......... -.......................................`.......s....`.........................................@...P............@.......0.........../...P..........T...........................@...@............................................text....w.......x.................. ..`.rdata.. y.......z...|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\_sqlite3.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):128272
                                                                                                                                                                                                                                                        Entropy (8bit):6.294497957566744
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:3072:N+tZdKmXhyn/qO6ItCpz6j5yQyshiKftdIJvQJL:NGZVwnxHssj5lhiYR
                                                                                                                                                                                                                                                        MD5:D4E5BE27410897AC5771966E33B418C7
                                                                                                                                                                                                                                                        SHA1:5D18FF3CC196557ED40F2F46540B2BFE02901D98
                                                                                                                                                                                                                                                        SHA-256:3E625978D7C55F4B609086A872177C4207FB483C7715E2204937299531394F4C
                                                                                                                                                                                                                                                        SHA-512:4D40B4C6684D3549C35ED96BEDD6707CE32DFAA8071AEADFBC682CF4B7520CFF08472F441C50E0D391A196510F8F073F26AE8B2D1E9B1AF5CF487259CC6CCC09
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V...7.7.7.Oc..7...7.....7...7.....7.....7...7..O.7.7.6.....7...7.....7...7.Rich.7.........................PE..d......g.........." ...)............................................................[.....`..........................................{..P...P{.........................../..............T...............................@...............H............................text...t........................... ..`.rdata.............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\_ssl.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):181520
                                                                                                                                                                                                                                                        Entropy (8bit):5.972827303352998
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:3072:kO+IWyXHllRhN1qhep7fM6CpqjZI8u7pUULbaLZErWreVEzvT3iFCNc6tYwJc1OW:kpSrhN1E2M6CpUuwg5dEW7
                                                                                                                                                                                                                                                        MD5:1C0E3E447F719FBE2601D0683EA566FC
                                                                                                                                                                                                                                                        SHA1:5321AB73B36675B238AB3F798C278195223CD7B1
                                                                                                                                                                                                                                                        SHA-256:63AE2FEFBFBBBC6EA39CDE0A622579D46FF55134BC8C1380289A2976B61F603E
                                                                                                                                                                                                                                                        SHA-512:E1A430DA2A2F6E0A1AED7A76CC4CD2760B3164ABC20BE304C1DB3541119942508E53EA3023A52B8BADA17A6052A7A51A4453EFAD1A888ACB3B196881226C2E5C
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FM.^.,k..,k..,k..T...,k...j..,k...h..,k...o..,k...n..,k.J.j..,k...j..,k..,j..-k.ITj..,k.J.f..,k.J.k..,k.J....,k.J.i..,k.Rich.,k.................PE..d......g.........." ...)............ /..............................................R\....`.............................................d................................/..............T...........................P...@............................................text...0........................... ..`.rdata..D%.......&..................@..@.data...`...........................@....pdata...............n..............@..@.rsrc................z..............@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\_wmi.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):38160
                                                                                                                                                                                                                                                        Entropy (8bit):6.338856805460127
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:768:fEkK9VgWOZbs3550QcJpPllIJLiX5YiSyvQ602Euf0:fE93jkbQcJvlIJLiJ7Syq00
                                                                                                                                                                                                                                                        MD5:1C30CC7DF3BD168D883E93C593890B43
                                                                                                                                                                                                                                                        SHA1:31465425F349DAE4EDAC9D0FEABC23CE83400807
                                                                                                                                                                                                                                                        SHA-256:6435C679A3A3FF4F16708EBC43F7CA62456C110AC1EA94F617D8052C90C143C7
                                                                                                                                                                                                                                                        SHA-512:267A1807298797B190888F769D998357B183526DFCB25A6F1413E64C5DCCF87F51424B7E5D6F2349D7A19381909AB23B138748D8D9F5858F7DC0552F5C5846AC
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H2.&a.&a.&a..a.&a..'`.&a..%`.&a.."`.&a..'`.&a..#`.&a..'`.&a.'a..&a.."`.&a../`.&a..&`.&a...a.&a..$`.&aRich.&a................PE..d.....g.........." ...).,...<.......)..............................................'.....`.........................................0V..H...xV.......................f.../......x...tG..T............................C..@............@.......T..@....................text....*.......,.................. ..`.rdata..d ...@..."...0..............@..@.data........p.......R..............@....pdata...............V..............@..@.rsrc................Z..............@..@.reloc..x............d..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\base_library.zip

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):1394456
                                                                                                                                                                                                                                                        Entropy (8bit):5.531698507573688
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:12288:IW7WpLV6yNLeGQbVz3YQfiBgDPtLwjFx278e6ZQnHS91lqyL+DXUgnxOr+dx5/GO:B7WpLtHa9BHSHAW+dx5/GP05vddD
                                                                                                                                                                                                                                                        MD5:A9CBD0455B46C7D14194D1F18CA8719E
                                                                                                                                                                                                                                                        SHA1:E1B0C30BCCD9583949C247854F617AC8A14CBAC7
                                                                                                                                                                                                                                                        SHA-256:DF6C19637D239BFEDC8CD13D20E0938C65E8FDF340622FF334DB533F2D30FA19
                                                                                                                                                                                                                                                        SHA-512:B92468E71490A8800E51410DF7068DD8099E78C79A95666ECF274A9E9206359F049490B8F60B96081FAFD872EC717E67020364BCFA972F26F0D77A959637E528
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:PK..........!..b.e............_collections_abc.pyc......................................\.....S.r.S.S.K.J.r.J.r. .S.S.K.r.\.".\.\.....5.......r.\.".S.5.......r.S...r.\.".\.5.......r.C./.S.Q.r.S.r.\.".\.".S.5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".0.R%..................5.......5.......5.......r.\.".\.".0.R)..................5.......5.......5.......r.\.".\.".0.R-..................5.......5.......5.......r.\.".\."./.5.......5.......r.\.".\.".\."./.5.......5.......5.......r.\.".\.".\.".S.5.......5.......5.......r.\.".\.".\.".S.S.-...5.......5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".S.5.......5.......r \.".\.".S.5.......5.......r!\.".\.".\"".5.......5.......5.......r#\.".0.R%..................5.......5.......r$\.".0.R)..................5.......5.......r%\.".0.R-..................5.......5.......r&\.".\.RN..................5.......r(S...r)\)".5.......r*C)\.".S...".5.......5.......r+S...r,\,".5.......r,\.".\,5.......r-\,R]..................5.......

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\certifi\cacert.pem

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):299427
                                                                                                                                                                                                                                                        Entropy (8bit):6.047872935262006
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
                                                                                                                                                                                                                                                        MD5:50EA156B773E8803F6C1FE712F746CBA
                                                                                                                                                                                                                                                        SHA1:2C68212E96605210EDDF740291862BDF59398AEF
                                                                                                                                                                                                                                                        SHA-256:94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
                                                                                                                                                                                                                                                        SHA-512:01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\charset_normalizer\md.cp313-win_amd64.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):10752
                                                                                                                                                                                                                                                        Entropy (8bit):4.818583535960129
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:96:Mvs10hZd9D74ACb0xx2uKynu10YLsgxwJiUNiL0U5IZsJFPGDtCFCCQAADo+cX6m:MXv9XFCk2z1/t12iwU5usJFuCyPcqgE
                                                                                                                                                                                                                                                        MD5:56FE4F6C7E88212161F49E823CCC989A
                                                                                                                                                                                                                                                        SHA1:16D5CBC5F289AD90AEAA4FF7CB828627AC6D4ACF
                                                                                                                                                                                                                                                        SHA-256:002697227449B6D69026D149CFB220AC85D83B13056C8AA6B9DAC3FD3B76CAA4
                                                                                                                                                                                                                                                        SHA-512:7C9D09CF9503F73E6F03D30E54DBB50606A86D09B37302DD72238880C000AE2B64C99027106BA340753691D67EC77B3C6E5004504269508F566BDB5E13615F1E
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k............r_...........r................................................3..........Rich....................PE..d....$.g.........." ...).....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data........0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\charset_normalizer\md__mypyc.cp313-win_amd64.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):124928
                                                                                                                                                                                                                                                        Entropy (8bit):5.953784637413928
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:3072:JDE+0ov6ojgN3qN8h51Zlh+YW5E38vCsmLS:JdefPZE2ICDLS
                                                                                                                                                                                                                                                        MD5:10116447F9276F10664BA85A5614BA3A
                                                                                                                                                                                                                                                        SHA1:EFD761A3E6D14E897D37AFB0C7317C797F7AE1D6
                                                                                                                                                                                                                                                        SHA-256:C393098E7803ABF08EE8F7381AD7B0F8FAFFBF66319C05D72823308E898F8CFC
                                                                                                                                                                                                                                                        SHA-512:C04461E52B7FE92D108CBDEB879B7A8553DD552D79C88DFA3F5D0036EED8D4B8C839C0BF2563BC0C796F8280ED2828CA84747CB781D2F26B44214FCA2091EAE4
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y.....................7...............7.......7.......7.......6..........D....6.......6.......6.......6......Rich............................PE..d....$.g.........." ...).@...........C.......................................0............`.........................................0...d.................................... ......................................P...@............P...............................text....?.......@.................. ..`.rdata..nY...P...Z...D..............@..@.data....=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\libcrypto-3.dll

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):5232408
                                                                                                                                                                                                                                                        Entropy (8bit):5.940072183736028
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
                                                                                                                                                                                                                                                        MD5:123AD0908C76CCBA4789C084F7A6B8D0
                                                                                                                                                                                                                                                        SHA1:86DE58289C8200ED8C1FC51D5F00E38E32C1AAD5
                                                                                                                                                                                                                                                        SHA-256:4E5D5D20D6D31E72AB341C81E97B89E514326C4C861B48638243BDF0918CFA43
                                                                                                                                                                                                                                                        SHA-512:80FAE0533BA9A2F5FA7806E86F0DB8B6AAB32620DDE33B70A3596938B529F3822856DE75BDDB1B06721F8556EC139D784BC0BB9C8DA0D391DF2C20A80D33CB04
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(..7..<......v........................................0P.......O...`...........................................H.0.....O.@....@O.|.... L. .....O../...PO.$...`{D.8............................yD.@.............O..............................text.....7.......7................. ..`.rdata........7.......7.............@..@.data...Ao....K..<....K.............@....pdata....... L.......K.............@..@.idata...%....O..&....N.............@..@.00cfg..u....0O.......N.............@..@.rsrc...|....@O.......N.............@..@.reloc..~....PO.......N.............@..B................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\libffi-8.dll

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):39696
                                                                                                                                                                                                                                                        Entropy (8bit):6.641880464695502
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
                                                                                                                                                                                                                                                        MD5:0F8E4992CA92BAAF54CC0B43AACCCE21
                                                                                                                                                                                                                                                        SHA1:C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
                                                                                                                                                                                                                                                        SHA-256:EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
                                                                                                                                                                                                                                                        SHA-512:6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\libssl-3.dll

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):792856
                                                                                                                                                                                                                                                        Entropy (8bit):5.57949182561317
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
                                                                                                                                                                                                                                                        MD5:4FF168AAA6A1D68E7957175C8513F3A2
                                                                                                                                                                                                                                                        SHA1:782F886709FEBC8C7CEBCEC4D92C66C4D5DBCF57
                                                                                                                                                                                                                                                        SHA-256:2E4D35B681A172D3298CAF7DC670451BE7A8BA27C26446EFC67470742497A950
                                                                                                                                                                                                                                                        SHA-512:C372B759B8C7817F2CBB78ECCC5A42FA80BDD8D549965BD925A97C3EEBDCE0335FBFEC3995430064DEAD0F4DB68EBB0134EB686A0BE195630C49F84B468113E3
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.>..|m..|m..|m.u.m..|m+.}l..|m.u}l..|m+..l..|m+.xl..|m+.yl..|m..}l..|m..}m..|m..xl..|m..|l..|m...m..|m..~l..|mRich..|m................PE..d......f.........." ...(.>..........K........................................0......!+....`..........................................x...Q..............s.... ...M......./......d...p...8...............................@............................................text....<.......>.................. ..`.rdata..hz...P...|...B..............@..@.data...qN.......H..................@....pdata..pV... ...X..................@..@.idata...c.......d...^..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..C...........................@..B........................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\pyexpat.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):201488
                                                                                                                                                                                                                                                        Entropy (8bit):6.375994899027017
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:6144:cAPHiRwroqoLHMpCSNVysh9CV2i6P/1vTg:6wrExSU6PdvTg
                                                                                                                                                                                                                                                        MD5:CF2C3D127F11CB2C026E151956745564
                                                                                                                                                                                                                                                        SHA1:B1C8C432FC737D6F455D8F642A4F79AD95A97BD3
                                                                                                                                                                                                                                                        SHA-256:D3E81017B4A82AE1B85E8CD6B9B7EB04D8817E29E5BC9ECE549AC24C8BB2FF23
                                                                                                                                                                                                                                                        SHA-512:FE3A9C8122FFFF4AF7A51DF39D40DF18E9DB3BC4AED6B161A4BE40A586AC93C1901ACDF64CC5BFFF6975D22073558FC7A37399D016296432057B8150848F636E
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1..P.P.P.(t..P...P...P...P...P....P..(.P.P..P....P....P......P....P.Rich.P.........................PE..d.....g.........." ...)..................................................... ............`............................................P... ............................/..........`4..T........................... 3..@............ ...............................text............................... ..`.rdata....... ......................@..@.data.... ..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\python313.dll

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):6083856
                                                                                                                                                                                                                                                        Entropy (8bit):6.126922729922386
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:49152:fXGc3O7T4DKX+vLFMmKYxiAYNBD987KdJlI9HbeX2jrgQcw6Zc4h67mM+XDQ3bLi:Of42zJiwJl/YF7v3vaHDMiEN3Kr
                                                                                                                                                                                                                                                        MD5:B9DE917B925DD246B709BB4233777EFD
                                                                                                                                                                                                                                                        SHA1:775F258D8B530C6EA9F0DD3D1D0B61C1948C25D2
                                                                                                                                                                                                                                                        SHA-256:0C0A66505093B6A4BB3475F716BD3D9552095776F6A124709C13B3F9552C7D99
                                                                                                                                                                                                                                                        SHA-512:F4BF3398F50FDD3AB7E3F02C1F940B4C8B5650ED7AF16C626CCD1B934053BA73A35F96DA03B349C1EB614BB23E0BC6B5CC58B07B7553A5C93C6D23124F324A33
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s]{v ]{v ]{v M.w!_{v M.. S{v M.u!Y{v M.r!U{v M.s!P{v T.. G{v ..w!V{v ]{w .zv ..{!.{v ..v!\{v ... \{v ..t!\{v Rich]{v ........................PE..d......g.........." ...).:+..T9......J........................................d.....uF]...`...........................................O.....h.P.......d......0].......\../....d..... A3.T.....................I.(....?3.@............P+..............................text....8+......:+................. ..`.rdata....%..P+...%..>+.............@..@.data...$9....P..N....P.............@....pdata.......0]...... U.............@..@PyRuntim.N...._..P....W.............@....rsrc.........d.......[.............@..@.reloc........d.......[.............@..B........................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\pywin32_system32\pywintypes313.dll

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):135680
                                                                                                                                                                                                                                                        Entropy (8bit):6.0205382324631955
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:3072:q9GPDeI1KuOQEbULZYY/r06YrqHXmZEdb/XAnLT:GgDJ1vOlbfY/rke3mZE9/XA
                                                                                                                                                                                                                                                        MD5:2A87D04E9E7CBFF67E8EA4F6315C0EBB
                                                                                                                                                                                                                                                        SHA1:CF5B2BB53B37087ECA18E509B8551ED5CB7575D9
                                                                                                                                                                                                                                                        SHA-256:D011068781CFBA0955258505DBE7E5C7D3D0B955E7F7640D2F1019D425278087
                                                                                                                                                                                                                                                        SHA-512:2138E051AC116D3ABE11101C75F8BD8388D7FBA89B15E6F82DC35FD78BDD913ED8BA468769F68440CE7834825806281AA15F0023855E3B8248266414D60A4A44
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.J+.z$x.z$x.z$x...x.z$xW.%y.z$xc..x.z$xW.!y.z$xW. y.z$xW.'y.z$xN. y.z$xM.%y.z$xN.%y.z$x.z%x.z$x..-y.z$x..$y.z$x..&y.z$xRich.z$x................PE..d...X..g.........." .........................................................`............`.........................................0...lB......,....@..l.... ...............P..0....a..T............................b..8...............p............................text...9........................... ..`.rdata..............................@..@.data....-.......(..................@....pdata....... ......................@..@.rsrc...l....@......................@..@.reloc..0....P......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\select.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):30992
                                                                                                                                                                                                                                                        Entropy (8bit):6.554484610649281
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:384:7hhxm9tKLhuoNHfzzlvFy0ZZIJ9GckHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:tCytHf98uZIJ9Gx5YiSyvy2ES
                                                                                                                                                                                                                                                        MD5:20831703486869B470006941B4D996F2
                                                                                                                                                                                                                                                        SHA1:28851DFD43706542CD3EF1B88B5E2749562DFEE0
                                                                                                                                                                                                                                                        SHA-256:78E5994C29D8851F28B5B12D59D742D876683AEA58ECEEA1FB895B2036CDCDEB
                                                                                                                                                                                                                                                        SHA-512:4AAF5D66D2B73F939B9A91E7EDDFEB2CE2476C625586EF227B312230414C064AA850B02A4028363AA4664408C9510594754530A6D026A0A84BE0168D677C1BC4
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........tV..'V..'V..'_.j'T..'F:.&T..'F:.&R..'F:.&^..'F:.&Z..'.;.&T..'V..'...'...&S..'.;.&W..'.;.&W..'.;.'W..'.;.&W..'RichV..'................PE..d.....g.........." ...).....2............................................................`..........................................@..L...<A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...p....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\INSTALLER

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):4
                                                                                                                                                                                                                                                        Entropy (8bit):1.5
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:3:Mn:M
                                                                                                                                                                                                                                                        MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                                        SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                                        SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                                        SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:pip.

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\LICENSE

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):11358
                                                                                                                                                                                                                                                        Entropy (8bit):4.4267168336581415
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEn7HbHR:U9vlKM1zJlFvmNz5VrlkTS07Ht
                                                                                                                                                                                                                                                        MD5:3B83EF96387F14655FC854DDC3C6BD57
                                                                                                                                                                                                                                                        SHA1:2B8B815229AA8A61E483FB4BA0588B8B6C491890
                                                                                                                                                                                                                                                        SHA-256:CFC7749B96F63BD31C3C42B5C471BF756814053E847C10F3EB003417BC523D30
                                                                                                                                                                                                                                                        SHA-512:98F6B79B778F7B0A15415BD750C3A8A097D650511CB4EC8115188E115C47053FE700F578895C097051C9BC3DFB6197C2B13A15DE203273E1A3218884F86E90E8
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:. Apache License. Version 2.0, January 2004. http://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial own

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\METADATA

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):4648
                                                                                                                                                                                                                                                        Entropy (8bit):5.006900644756252
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:96:Dx2ZSaCSmS8R902Vpnu386eLQ9Ac+fFZpDN00x2jZ2SBXZJSwTE:9Smzf02Vpnu386mQ9B+TP0vJHJSwTE
                                                                                                                                                                                                                                                        MD5:98ABEAACC0E0E4FC385DFF67B607071A
                                                                                                                                                                                                                                                        SHA1:E8C830D8B0942300C7C87B3B8FD15EA1396E07BD
                                                                                                                                                                                                                                                        SHA-256:6A7B90EFFEE1E09D5B484CDF7232016A43E2D9CC9543BCBB8E494B1EC05E1F59
                                                                                                                                                                                                                                                        SHA-512:F1D59046FFA5B0083A5259CEB03219CCDB8CC6AAC6247250CBD83E70F080784391FCC303F7630E1AD40E5CCF5041A57CB9B68ADEFEC1EBC6C31FCF7FFC65E9B7
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:Metadata-Version: 2.1.Name: importlib_metadata.Version: 8.0.0.Summary: Read metadata from Python packages.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Source, https://github.com/python/importlib_metadata.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: zipp >=0.5.Requires-Dist: typing-extensions >=3.6.4 ; python_version < "3.8".Provides-Extra: doc.Requires-Dist: sphinx >=3.5 ; extra == 'doc'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'doc'.Requires-Dist: rst.linker >=1.9 ; extra == 'doc'.Requires-Dist: furo ; extra == 'doc'.Requires-Dist: sphinx-lint ; extra == 'doc'.Requires-Dist: jaraco.tidelift >=1.4 ; extra == 'doc'.Provides-Extra: perf.Requires-D

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\RECORD

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):2518
                                                                                                                                                                                                                                                        Entropy (8bit):5.6307766747793275
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:48:UnuXTg06U5J/Vw9l/gfNX7/XzBk9pvJq/fwJOfYrBfnJ/V0XJnzN/3WJV:bXzP/EgdzzBkDJsoIYrBfJ/CXNz9qV
                                                                                                                                                                                                                                                        MD5:EB513CAFA5226DDA7D54AFDCC9AD8A74
                                                                                                                                                                                                                                                        SHA1:B394C7AEC158350BAF676AE3197BEF4D7158B31C
                                                                                                                                                                                                                                                        SHA-256:0D8D3C6EEB9EBBE86CAC7D60861552433C329DA9EA51248B61D02BE2E5E64030
                                                                                                                                                                                                                                                        SHA-512:A0017CFAFF47FDA6067E3C31775FACEE4728C3220C2D4BD70DEF328BD20AA71A343E39DA15CD6B406F62311894C518DFCF5C8A4AE6F853946F26A4B4E767924E
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:importlib_metadata-8.0.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..importlib_metadata-8.0.0.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358..importlib_metadata-8.0.0.dist-info/METADATA,sha256=anuQ7_7h4J1bSEzfcjIBakPi2cyVQ7y7jklLHsBeH1k,4648..importlib_metadata-8.0.0.dist-info/RECORD,,..importlib_metadata-8.0.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..importlib_metadata-8.0.0.dist-info/WHEEL,sha256=mguMlWGMX-VHnMpKOjjQidIo1ssRlCFu4a4mBpz1s2M,91..importlib_metadata-8.0.0.dist-info/top_level.txt,sha256=CO3fD9yylANiXkrMo4qHLV_mqXL2sC5JFKgt1yWAT-A,19..importlib_metadata/__init__.py,sha256=tZNB-23h8Bixi9uCrQqj9Yf0aeC--Josdy3IZRIQeB0,33798..importlib_metadata/__pycache__/__init__.cpython-312.pyc,,..importlib_metadata/__pycache__/_adapters.cpython-312.pyc,,..importlib_metadata/__pycache__/_collections.cpython-312.pyc,,..importlib_metadata/__pycache__/_compat.cpython-312.pyc,,..importlib_metadata/__pycac

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\WHEEL

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):91
                                                                                                                                                                                                                                                        Entropy (8bit):4.687870576189661
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:3:RtEeXMRYFAVLMvhRRP+tPCCfA5S:RtC1VLMvhjWBBf
                                                                                                                                                                                                                                                        MD5:7D09837492494019EA51F4E97823D79F
                                                                                                                                                                                                                                                        SHA1:7829B4324BB542799494131A270EC3BDAD4DEDEF
                                                                                                                                                                                                                                                        SHA-256:9A0B8C95618C5FE5479CCA4A3A38D089D228D6CB1194216EE1AE26069CF5B363
                                                                                                                                                                                                                                                        SHA-512:A0063220ECDD22C3E735ACFF6DE559ACF3AC4C37B81D37633975A22A28B026F1935CD1957C0FF7D2ECC8B7F83F250310795EECC5273B893FFAB115098F7B9C38
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:Wheel-Version: 1.0.Generator: setuptools (70.1.1).Root-Is-Purelib: true.Tag: py3-none-any..

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):19
                                                                                                                                                                                                                                                        Entropy (8bit):3.536886723742169
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:3:JSej0EBERG:50o4G
                                                                                                                                                                                                                                                        MD5:A24465F7850BA59507BF86D89165525C
                                                                                                                                                                                                                                                        SHA1:4E61F9264DE74783B5924249BCFE1B06F178B9AD
                                                                                                                                                                                                                                                        SHA-256:08EDDF0FDCB29403625E4ACCA38A872D5FE6A972F6B02E4914A82DD725804FE0
                                                                                                                                                                                                                                                        SHA-512:ECF1F6B777970F5257BDDD353305447083008CEBD8E5A27C3D1DA9C7BDC3F9BF3ABD6881265906D6D5E11992653185C04A522F4DB5655FF75EEDB766F93D5D48
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:importlib_metadata.

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor\jaraco\text\Lorem ipsum.txt

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (888)
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):1335
                                                                                                                                                                                                                                                        Entropy (8bit):4.226823573023539
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:24:FP6Hbz+g9RPZ14bJi04L6GEbX4UQF4UkZQhxI2EIhNyu:9E+i6bJmLm43+Uxxnh0u
                                                                                                                                                                                                                                                        MD5:4CE7501F6608F6CE4011D627979E1AE4
                                                                                                                                                                                                                                                        SHA1:78363672264D9CD3F72D5C1D3665E1657B1A5071
                                                                                                                                                                                                                                                        SHA-256:37FEDCFFBF73C4EB9F058F47677CB33203A436FF9390E4D38A8E01C9DAD28E0B
                                                                                                                                                                                                                                                        SHA-512:A4CDF92725E1D740758DA4DD28DF5D1131F70CEF46946B173FE6956CC0341F019D7C4FECC3C9605F354E1308858721DADA825B4C19F59C5AD1CE01AB84C46B24
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum..Curabitur pretium tincidunt lacus. Nulla gravida orci a odio. Nullam varius, turpis et commodo pharetra, est eros bibendum elit, nec luctus magna felis sollicitudin mauris. Integer in mauris eu nibh euismod gravida. Duis ac tellus et risus vulputate vehicula. Donec lobortis risus a elit. Etiam tempor. Ut ullamcorper, ligula eu tempor congue, eros est euismod turpis, id tincidunt sapien risus a quam. Maecenas fermentum consequat mi. Donec fermentum. Pellentesque malesuada nulla a mi. Duis sapien sem, aliquet nec, commodo eget, consequat quis, neque.

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor\wheel-0.43.0.dist-info\INSTALLER

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):4
                                                                                                                                                                                                                                                        Entropy (8bit):1.5
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:3:Mn:M
                                                                                                                                                                                                                                                        MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                                        SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                                        SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                                        SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:pip.

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):1107
                                                                                                                                                                                                                                                        Entropy (8bit):5.115074330424529
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:24:PWmrRONJHLH0cPP3gtkHw1h39QHOsUv4eOk4/+jvho3nPz:ttONJbbvE/NQHOs5eNS3n7
                                                                                                                                                                                                                                                        MD5:7FFB0DB04527CFE380E4F2726BD05EBF
                                                                                                                                                                                                                                                        SHA1:5B39C45A91A556E5F1599604F1799E4027FA0E60
                                                                                                                                                                                                                                                        SHA-256:30C23618679108F3E8EA1D2A658C7CA417BDFC891C98EF1A89FA4FF0C9828654
                                                                                                                                                                                                                                                        SHA-512:205F284F3A7E8E696C70ED7B856EE98C1671C68893F0952EEC40915A383BC452B99899BDC401F9FE161A1BF9B6E2CEA3BCD90615EEE9173301657A2CE4BAFE14
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MIT License..Copyright (c) 2012 Daniel Holth <dholth@fastmail.fm> and contributors..Permission is hereby granted, free of charge, to any person obtaining a.copy of this software and associated documentation files (the "Software"),.to deal in the Software without restriction, including without limitation.the rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included.in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL.THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR.OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERW

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor\wheel-0.43.0.dist-info\METADATA

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:Unicode text, UTF-8 text
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):2153
                                                                                                                                                                                                                                                        Entropy (8bit):5.088249746074878
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:48:DEhpFu5MktjaywDK48d+md+7uT8RfkD1UKd+mOl1Awry:DEhpiMktjayq/7kOfsUzmbYy
                                                                                                                                                                                                                                                        MD5:EBEA27DA14E3F453119DC72D84343E8C
                                                                                                                                                                                                                                                        SHA1:7CEB6DBE498B69ABF4087637C6F500742FF7E2B4
                                                                                                                                                                                                                                                        SHA-256:59BAC22B00A59D3E5608A56B8CF8EFC43831A36B72792EE4389C9CD4669C7841
                                                                                                                                                                                                                                                        SHA-512:A41593939B9325D40CB67FD3F41CD1C9E9978F162487FB469094C41440B5F48016B9A66BE2E6E4A0406D6EEDB25CE4F5A860BA1E3DC924B81F63CEEE3AE31117
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:Metadata-Version: 2.1.Name: wheel.Version: 0.43.0.Summary: A built-package format for Python.Keywords: wheel,packaging.Author-email: Daniel Holth <dholth@fastmail.fm>.Maintainer-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Dist: pytest >= 6.0.0 ; extra == "test".Requires-Dist: setuptools >= 65 ; extra == "test".Project-URL: Changelog, https://wheel.readthedocs.io/en/s

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor\wheel-0.43.0.dist-info\RECORD

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:CSV text
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):4557
                                                                                                                                                                                                                                                        Entropy (8bit):5.714200636114494
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:96:QXVuEmegx01TQIvFCiq9H/H7vp88FxTXiJPkGJP4CWweXQHmnDpMI78IegK5EeZR:QXVxAbYkU4CWweXQHmnDpMeV2BvTRqQF
                                                                                                                                                                                                                                                        MD5:44D352C4997560C7BFB82D9360F5985A
                                                                                                                                                                                                                                                        SHA1:BE58C7B8AB32790384E4E4F20865C4A88414B67A
                                                                                                                                                                                                                                                        SHA-256:783E654742611AF88CD9F00BF01A431A219DB536556E63FF981C7BD673070AC9
                                                                                                                                                                                                                                                        SHA-512:281B1D939A560E6A08D0606E5E8CE15F086B4B45738AB41ED6B5821968DC8D764CD6B25DB6BA562A07018C271ABF17A6BC5A380FAD05696ADF1D11EE2C5749C8
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:../../bin/wheel,sha256=cT2EHbrv-J-UyUXu26cDY-0I7RgcruysJeHFanT1Xfo,249..wheel-0.43.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..wheel-0.43.0.dist-info/LICENSE.txt,sha256=MMI2GGeRCPPo6h0qZYx8pBe9_IkcmO8aifpP8MmChlQ,1107..wheel-0.43.0.dist-info/METADATA,sha256=WbrCKwClnT5WCKVrjPjvxDgxo2tyeS7kOJyc1GaceEE,2153..wheel-0.43.0.dist-info/RECORD,,..wheel-0.43.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..wheel-0.43.0.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..wheel-0.43.0.dist-info/entry_points.txt,sha256=rTY1BbkPHhkGMm4Q3F0pIzJBzW2kMxoG1oriffvGdA0,104..wheel/__init__.py,sha256=D6jhH00eMzbgrXGAeOwVfD5i-lCAMMycuG1L0useDlo,59..wheel/__main__.py,sha256=NkMUnuTCGcOkgY0IBLgBCVC_BGGcWORx2K8jYGS12UE,455..wheel/__pycache__/__init__.cpython-312.pyc,,..wheel/__pycache__/__main__.cpython-312.pyc,,..wheel/__pycache__/_setuptools_logging.cpython-312.pyc,,..wheel/__pycache__/bdist_wheel.cpython-312.pyc,,..wheel/__pycache

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor\wheel-0.43.0.dist-info\WHEEL

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):81
                                                                                                                                                                                                                                                        Entropy (8bit):4.672346887071811
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
                                                                                                                                                                                                                                                        MD5:24019423EA7C0C2DF41C8272A3791E7B
                                                                                                                                                                                                                                                        SHA1:AAE9ECFB44813B68CA525BA7FA0D988615399C86
                                                                                                                                                                                                                                                        SHA-256:1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
                                                                                                                                                                                                                                                        SHA-512:09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\setuptools\_vendor\wheel-0.43.0.dist-info\entry_points.txt

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:ASCII text
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):104
                                                                                                                                                                                                                                                        Entropy (8bit):4.271713330022269
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:3:1SSAnAYgh+MWTMhk6WjrAM5t5ln:1Jb9WTMhk9jUM5t5ln
                                                                                                                                                                                                                                                        MD5:6180E17C30BAE5B30DB371793FCE0085
                                                                                                                                                                                                                                                        SHA1:E3A12C421562A77D90A13D8539A3A0F4D3228359
                                                                                                                                                                                                                                                        SHA-256:AD363505B90F1E1906326E10DC5D29233241CD6DA4331A06D68AE27DFBC6740D
                                                                                                                                                                                                                                                        SHA-512:69EAE7B1E181D7BA1D3E2864D31E1320625A375E76D3B2FBF8856B3B6515936ACE3138D4D442CABDE7576FCFBCBB0DEED054D90B95CFA1C99829DB12A9031E26
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:[console_scripts].wheel=wheel.cli:main..[distutils.commands].bdist_wheel=wheel.bdist_wheel:bdist_wheel..

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\sqlite3.dll

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):1540368
                                                                                                                                                                                                                                                        Entropy (8bit):6.577233901213655
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:24576:cmKZpHTv4iPI9FDgJNRs++l8GwLXSz4ih5Z5jWbsxuIl40OwumzuLxIhiE:0rJoDgJNRs+U8GwLXSMIZ5jWb0uIl48R
                                                                                                                                                                                                                                                        MD5:7E632F3263D5049B14F5EDC9E7B8D356
                                                                                                                                                                                                                                                        SHA1:92C5B5F96F1CBA82D73A8F013CBAF125CD0898B8
                                                                                                                                                                                                                                                        SHA-256:66771FBD64E2D3B8514DD0CD319A04CA86CE2926A70F7482DDEC64049E21BE38
                                                                                                                                                                                                                                                        SHA-512:CA1CC67D3EB63BCA3CE59EF34BECCE48042D7F93B807FFCD4155E4C4997DC8B39919AE52AB4E5897AE4DBCB47592C4086FAC690092CAA7AA8D3061FBA7FE04A2
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......gsX.#.6.#.6.#.6.*j../.6.3.7.!.6.3.5.'.6.3.2.+.6.3.3...6.hj7. .6.#.7...6.k.>.".6.k.6.".6.k..".6.k.4.".6.Rich#.6.........................PE..d.....g.........." ...).0...(.......................................................P....`..............................................#...........`...............R.../...p..X...0...T..............................@............@..X............................text...9........0.................. ..`.rdata..,....@.......4..............@..@.data...`M...0...D..................@....pdata...............\..............@..@.rsrc........`.......8..............@..@.reloc..X....p.......B..............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\unicodedata.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):709904
                                                                                                                                                                                                                                                        Entropy (8bit):5.861739047785334
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:12288:FYGdLI/X77mvfldCKGihH32W3cnPSqrUgLIe:FYGW7qNxr3cnPXLIe
                                                                                                                                                                                                                                                        MD5:0902D299A2A487A7B0C2D75862B13640
                                                                                                                                                                                                                                                        SHA1:04BCBD5A11861A03A0D323A8050A677C3A88BE13
                                                                                                                                                                                                                                                        SHA-256:2693C7EE4FBA55DC548F641C0CB94485D0E18596FFEF16541BD43A5104C28B20
                                                                                                                                                                                                                                                        SHA-512:8CBEF5A9F2D24DA1014F8F1CCBDDD997A084A0B04DD56BCB6AC38DDB636D05EF7E4EA7F67A085363AAD3F43D45413914E55BDEF14A662E80BE955E6DFC2FECA3
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q.............(.....(.....(.....(.....)................).....).....)x....)....Rich..................PE..d.....g.........." ...).B...f......P,..............................................<.....`.........................................P...X................................/..........p...T...........................0...@............`..h............................text....@.......B.................. ..`.rdata...?...`...@...F..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI39162\win32\win32crypt.pyd

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):125440
                                                                                                                                                                                                                                                        Entropy (8bit):5.967992588245897
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:1536:7ErQXAv52qRoQ79rwlaGVBA+xdPQQL1kUgZAO+sm2c83mL7g2kbB47a:7EgCiQ9roEoJptO+1pRL7ghbB47a
                                                                                                                                                                                                                                                        MD5:94049E023814436E0A3560474F7057D1
                                                                                                                                                                                                                                                        SHA1:28DDCCEE782B9613CE06224E2C80F67FBB2E16C7
                                                                                                                                                                                                                                                        SHA-256:306022128185B4608E49400B7A3FD5954FF524C201D989833CB3AA5856562E97
                                                                                                                                                                                                                                                        SHA-512:FCC00194624B668B39AB29D9D07F080668FB564C6558A9AB8E736052FB8CA596803A4B03DEE827BE915ACCB65251804A7661E976D314A453806D67DCE1269CF6
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g..I...I...I...@~r.O....s..M....s..Y....s..A....s..J...s..K.......K....~..N...I......s..@...s..H...s..H...RichI...........................PE..d...e..g.........." ................(........................................0............`.............................................................d.................... ..H....W..T............................W..8............ ...............................text...~........................... ..`.rdata..p.... ......................@..@.data....-.......(..................@....pdata..............................@..@.rsrc...d...........................@..@.reloc..H.... ......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):3266048
                                                                                                                                                                                                                                                        Entropy (8bit):6.660535254211377
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:49152:f8b8hJPihGwpbG0jjgdqtjGPzXbRIo9HleY4srXld:f08hBihGwpbG0jjgdqtqr4O
                                                                                                                                                                                                                                                        MD5:F54491FDB13ECAB8B06510F1C8431032
                                                                                                                                                                                                                                                        SHA1:2E42F6E1A1A559A6EA6DBB974F68D3F598E568FC
                                                                                                                                                                                                                                                        SHA-256:40ADBA8FC61052A26BAEB280F4645287CE1390E81BA42FF57B746F71B1C9F623
                                                                                                                                                                                                                                                        SHA-512:974BEE8B43F27CFD9D3539C9B2A9BAB886B0A91141DDEF9362846B7424773C5D4BE5BB88D1CA3905D7DA06C2315A69494D064926896212237AE0057A72938E0B
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................2.....'.1...@.................................W...k.............................1...............................1..................................................... . ............................@....rsrc...............................@....idata ............................@...sihywpwu. +.......+.................@...snftdmjr......1.......1.............@....taggant.0....1.."....1.............@...........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                        Category:modified
                                                                                                                                                                                                                                                        Size (bytes):26
                                                                                                                                                                                                                                                        Entropy (8bit):3.95006375643621
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:3:ggPYV:rPYV
                                                                                                                                                                                                                                                        MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                                                                                                                                                        SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                                                                                                                                                        SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                                                                                                                                                        SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                                                                                                                                                        Malicious:true
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:[ZoneTransfer]....ZoneId=0

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\places.sqlite-shm

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe
                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):32768
                                                                                                                                                                                                                                                        Entropy (8bit):0.017262956703125623
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                                                                                                                                                                                        MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                                                                                                                                                                                        SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                                                                                                                                                                                        SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                                                                                                                                                                                        SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\prefs-1.js

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (1808), with CRLF line terminators
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):10780
                                                                                                                                                                                                                                                        Entropy (8bit):5.490003400075434
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:192:HnBRNC3YbBp6lR1+PaX56/x8lCz9/3/OHNBw8MXSl:Oee1M/xbUPw70
                                                                                                                                                                                                                                                        MD5:573E3493A89E569800F845C62085E9AD
                                                                                                                                                                                                                                                        SHA1:A5F018A1F094B5DBD42B31CE60F7E7170CFF29D8
                                                                                                                                                                                                                                                        SHA-256:9D4B7FFDA8ED67F8205701A36EC908BA7B099C058A75E5073F761362D9B729B8
                                                                                                                                                                                                                                                        SHA-512:3207F9F8964B77883803D6A3622A53D08D8C8BA94186B3751492378E220A2ED37A557B0E084F06F27F435F814FF2F2F09D2A55B169A2725E3BA8576379DFAB3E
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "ecedec8f-7097-47fc-a9e3-d74f0c8e2503");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696499493);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696499494);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\prefs.js (copy)

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                        File Type:ASCII text, with very long lines (1808), with CRLF line terminators
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):10780
                                                                                                                                                                                                                                                        Entropy (8bit):5.490003400075434
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:192:HnBRNC3YbBp6lR1+PaX56/x8lCz9/3/OHNBw8MXSl:Oee1M/xbUPw70
                                                                                                                                                                                                                                                        MD5:573E3493A89E569800F845C62085E9AD
                                                                                                                                                                                                                                                        SHA1:A5F018A1F094B5DBD42B31CE60F7E7170CFF29D8
                                                                                                                                                                                                                                                        SHA-256:9D4B7FFDA8ED67F8205701A36EC908BA7B099C058A75E5073F761362D9B729B8
                                                                                                                                                                                                                                                        SHA-512:3207F9F8964B77883803D6A3622A53D08D8C8BA94186B3751492378E220A2ED37A557B0E084F06F27F435F814FF2F2F09D2A55B169A2725E3BA8576379DFAB3E
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "ecedec8f-7097-47fc-a9e3-d74f0c8e2503");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696499493);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696499494);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\sessionCheckpoints.json (copy)

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):53
                                                                                                                                                                                                                                                        Entropy (8bit):4.136624295551173
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:3:YVXKQJAyiVLQwJtJDBA+AY:Y9KQOy6Lb1BA+9
                                                                                                                                                                                                                                                        MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
                                                                                                                                                                                                                                                        SHA1:B43BC4B3EA206A02EF8F63D5BFAD0C96BF2A3B2A
                                                                                                                                                                                                                                                        SHA-256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
                                                                                                                                                                                                                                                        SHA-512:076EE83534F42563046D25086166F82E1A3EC61840C113AEC67ABE2D8195DAA247D827D0C54E7E8F8A1BBF2D082A3763577587E84342EC160FF97905243E6D19
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:{"profile-after-change":true,"final-ui-startup":true}

                                                                                                                                                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\sessionCheckpoints.json.tmp

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                        File Type:JSON data
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):53
                                                                                                                                                                                                                                                        Entropy (8bit):4.136624295551173
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:3:YVXKQJAyiVLQwJtJDBA+AY:Y9KQOy6Lb1BA+9
                                                                                                                                                                                                                                                        MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
                                                                                                                                                                                                                                                        SHA1:B43BC4B3EA206A02EF8F63D5BFAD0C96BF2A3B2A
                                                                                                                                                                                                                                                        SHA-256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
                                                                                                                                                                                                                                                        SHA-512:076EE83534F42563046D25086166F82E1A3EC61840C113AEC67ABE2D8195DAA247D827D0C54E7E8F8A1BBF2D082A3763577587E84342EC160FF97905243E6D19
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:{"profile-after-change":true,"final-ui-startup":true}

                                                                                                                                                                                                                                                        C:\Windows\Tasks\skotes.job

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                                        File Type:data
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):278
                                                                                                                                                                                                                                                        Entropy (8bit):3.3768875265192
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:6:Xpz4X37UEZ+lX1CGdKUe6tIxW+Za/y0ldAEt0:ZzS37Q1CGAFFc2a/VKEt0
                                                                                                                                                                                                                                                        MD5:93994FA184F748D5CC0642A7CF62A4B5
                                                                                                                                                                                                                                                        SHA1:9768472E51B9624E0A574FFBB83B3882676A3832
                                                                                                                                                                                                                                                        SHA-256:AB5932F4990C4ED84D1758B826647CB70AF156C51DE111A30F2EB5530DC01C90
                                                                                                                                                                                                                                                        SHA-512:FDCE320259D6F8A0FE0E791929EDFE12C89D2385A8AEEF4AEDBDF59EF162BAA6771540AA4A44D795391270E70450F7A59C3806E539FA4A4BE4361EA1095B8774
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:......hO.GO.:./..F.......<... .....s.......... ....................7.C.:.\.U.s.e.r.s.\.b.r.o.k.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........B.R.O.K.-.P.C.\.b.r.o.k...................0...................@3P.........................

                                                                                                                                                                                                                                                        C:\Windows\appcompat\Programs\Amcache.hve

                                                                                                                                                                                                                                                        Download File
                                                                                                                                                                                                                                                        Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                        File Type:MS Windows registry file, NT/2000 or above
                                                                                                                                                                                                                                                        Category:dropped
                                                                                                                                                                                                                                                        Size (bytes):1835008
                                                                                                                                                                                                                                                        Entropy (8bit):4.29600124127974
                                                                                                                                                                                                                                                        Encrypted:false
                                                                                                                                                                                                                                                        SSDEEP:6144:341fWRYkg7Di2vXoy00lWZgiWaaKxC44Q0NbuDs+IMj5mBMZJh1Vji:o1/YCW2AoQ0NiTj5wMHrVG
                                                                                                                                                                                                                                                        MD5:3C74802B99D63A7B648CF6B98A5F7298
                                                                                                                                                                                                                                                        SHA1:C26357BBA3651F75667F29261F0A8AD4E2D9D774
                                                                                                                                                                                                                                                        SHA-256:7B7B8894C940AB4CD439ED4EB7E1A37DC743BDE5CE23967B090321FE249AE4AC
                                                                                                                                                                                                                                                        SHA-512:4C6D5503798DC4B9FA0829E934C56DE25B249BD1AE9A16912A1818049FCB47F2B6C2D080C297B99F4112097F95562C3080203E440391E8B400FEBB0D7EF0699C
                                                                                                                                                                                                                                                        Malicious:false
                                                                                                                                                                                                                                                        Reputation:unknown
                                                                                                                                                                                                                                                        Preview:regfG...G....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...d.`..............................................................................................................................................................................................................................................................................................................................................B.P........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                        Static File Info

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                        Entropy (8bit):6.660535254211377
                                                                                                                                                                                                                                                        TrID:
                                                                                                                                                                                                                                                        • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                                                                                        • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                                                                        • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                                                        File name:file.exe
                                                                                                                                                                                                                                                        File size:3'266'048 bytes
                                                                                                                                                                                                                                                        MD5:f54491fdb13ecab8b06510f1c8431032
                                                                                                                                                                                                                                                        SHA1:2e42f6e1a1a559a6ea6dbb974f68d3f598e568fc
                                                                                                                                                                                                                                                        SHA256:40adba8fc61052a26baeb280f4645287ce1390e81ba42ff57b746f71b1c9f623
                                                                                                                                                                                                                                                        SHA512:974bee8b43f27cfd9d3539c9b2a9bab886b0a91141ddef9362846b7424773c5d4be5bb88d1ca3905d7da06c2315a69494d064926896212237ae0057a72938e0b
                                                                                                                                                                                                                                                        SSDEEP:49152:f8b8hJPihGwpbG0jjgdqtjGPzXbRIo9HleY4srXld:f08hBihGwpbG0jjgdqtqr4O
                                                                                                                                                                                                                                                        TLSH:4EE55B62F80972CBDA4F16745427CDC29A3F06B9071589C39868E6F9BDE3CC097B5D28
                                                                                                                                                                                                                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

                                                                                                                                                                                                                                                        File Icon

                                                                                                                                                                                                                                                        Icon Hash:90cececece8e8eb0

                                                                                                                                                                                                                                                        Static PE Info

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Entrypoint:0x71e000
                                                                                                                                                                                                                                                        Entrypoint Section:.taggant
                                                                                                                                                                                                                                                        Digitally signed:false
                                                                                                                                                                                                                                                        Imagebase:0x400000
                                                                                                                                                                                                                                                        Subsystem:windows gui
                                                                                                                                                                                                                                                        Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                                                                                                                                                        DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                                                        Time Stamp:0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
                                                                                                                                                                                                                                                        TLS Callbacks:
                                                                                                                                                                                                                                                        CLR (.Net) Version:
                                                                                                                                                                                                                                                        OS Version Major:6
                                                                                                                                                                                                                                                        OS Version Minor:0
                                                                                                                                                                                                                                                        File Version Major:6
                                                                                                                                                                                                                                                        File Version Minor:0
                                                                                                                                                                                                                                                        Subsystem Version Major:6
                                                                                                                                                                                                                                                        Subsystem Version Minor:0
                                                                                                                                                                                                                                                        Import Hash:2eabe9054cad5152567f0699947a2c5b

                                                                                                                                                                                                                                                        Entrypoint Preview

                                                                                                                                                                                                                                                        Instruction
                                                                                                                                                                                                                                                        jmp 00007FF634C48FFAh
                                                                                                                                                                                                                                                        lfs esi, dword ptr [ecx]
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add cl, ch
                                                                                                                                                                                                                                                        add byte ptr [eax], ah
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [esi], al
                                                                                                                                                                                                                                                        or al, byte ptr [eax]
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], dh
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [esi], al
                                                                                                                                                                                                                                                        or al, byte ptr [eax]
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [ecx], al
                                                                                                                                                                                                                                                        add byte ptr [eax], 00000000h
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        adc byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        or ecx, dword ptr [edx]
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al
                                                                                                                                                                                                                                                        add byte ptr [eax], al

                                                                                                                                                                                                                                                        Data Directories

                                                                                                                                                                                                                                                        NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x6a0570x6b.idata
                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x690000x5d4.rsrc
                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x31c3100x10sihywpwu
                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_TLS0x31c2c00x18sihywpwu
                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                                                        Sections

                                                                                                                                                                                                                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                                        0x10000x680000x68000d632dc3394074b2800cf35a414b0dc45False0.5572744516225961data7.019860685017432IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                                        .rsrc0x690000x5d40x4000007bf14ad5c1c4874fe7edac3bd60c6False0.70703125data5.882066484983677IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                                        .idata 0x6a0000x10000x200cc76e3822efdc911f469a3e3cc9ce9feFalse0.1484375data1.0428145631430756IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                                        sihywpwu0x6b0000x2b20000x2b1a00efbb02a4cc85e1231f9f16a25e5d135funknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                                        snftdmjr0x31d0000x10000x400fb2302b3310f3c846053178cd8619ff2False0.7900390625data6.1388308777489025IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                                        .taggant0x31e0000x30000x2200511c72d4557fe3c7193f46a37d0e9c96False0.06089154411764706DOS executable (COM)0.7503800222433393IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

                                                                                                                                                                                                                                                        Resources

                                                                                                                                                                                                                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                                                        RT_MANIFEST0x31c3200x3e4XML 1.0 document, ASCII text0.48092369477911645
                                                                                                                                                                                                                                                        RT_MANIFEST0x31c7040x17dXML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.5931758530183727

                                                                                                                                                                                                                                                        Imports

                                                                                                                                                                                                                                                        DLLImport
                                                                                                                                                                                                                                                        kernel32.dlllstrcpy

                                                                                                                                                                                                                                                        Possible Origin

                                                                                                                                                                                                                                                        Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                                                                        EnglishUnited States

                                                                                                                                                                                                                                                        Network Behavior

                                                                                                                                                                                                                                                        ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

                                                                                                                                                                                                                                                        Statistics

                                                                                                                                                                                                                                                        CPU Usage

                                                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                                                        Memory Usage

                                                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                                                        High Level Behavior Distribution

                                                                                                                                                                                                                                                        Click to dive into process behavior distribution

                                                                                                                                                                                                                                                        Behavior

                                                                                                                                                                                                                                                        Click to jump to process

                                                                                                                                                                                                                                                        System Behavior

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:1
                                                                                                                                                                                                                                                        Start time:07:18:19
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Users\user\Desktop\file.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                        Commandline:"C:\Users\user\Desktop\file.exe"
                                                                                                                                                                                                                                                        Imagebase:0x5d0000
                                                                                                                                                                                                                                                        File size:3'266'048 bytes
                                                                                                                                                                                                                                                        MD5 hash:F54491FDB13ECAB8B06510F1C8431032
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                                        • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:2
                                                                                                                                                                                                                                                        Start time:07:18:23
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
                                                                                                                                                                                                                                                        Imagebase:0x650000
                                                                                                                                                                                                                                                        File size:3'266'048 bytes
                                                                                                                                                                                                                                                        MD5 hash:F54491FDB13ECAB8B06510F1C8431032
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                                        • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1479494441.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:3
                                                                                                                                                                                                                                                        Start time:07:18:23
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                        Commandline:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        Imagebase:0x650000
                                                                                                                                                                                                                                                        File size:3'266'048 bytes
                                                                                                                                                                                                                                                        MD5 hash:F54491FDB13ECAB8B06510F1C8431032
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                                        • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.1486452961.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:5
                                                                                                                                                                                                                                                        Start time:07:19:00
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                        Commandline:C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                                                                                                                                                                                                                        Imagebase:0x650000
                                                                                                                                                                                                                                                        File size:3'266'048 bytes
                                                                                                                                                                                                                                                        MD5 hash:F54491FDB13ECAB8B06510F1C8431032
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:9
                                                                                                                                                                                                                                                        Start time:07:19:19
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe"
                                                                                                                                                                                                                                                        Imagebase:0x7ff6eb830000
                                                                                                                                                                                                                                                        File size:13'955'025 bytes
                                                                                                                                                                                                                                                        MD5 hash:CB538563778A18D571E87AD75705668E
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Antivirus matches:
                                                                                                                                                                                                                                                        • Detection: 48%, ReversingLabs
                                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:10
                                                                                                                                                                                                                                                        Start time:07:19:22
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\1033606001\c061393b55.exe"
                                                                                                                                                                                                                                                        Imagebase:0x7ff6eb830000
                                                                                                                                                                                                                                                        File size:13'955'025 bytes
                                                                                                                                                                                                                                                        MD5 hash:CB538563778A18D571E87AD75705668E
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:11
                                                                                                                                                                                                                                                        Start time:07:19:23
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exe"
                                                                                                                                                                                                                                                        Imagebase:0x5f0000
                                                                                                                                                                                                                                                        File size:349'696 bytes
                                                                                                                                                                                                                                                        MD5 hash:6446A00EB59754E15749AF229B0D5217
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Antivirus matches:
                                                                                                                                                                                                                                                        • Detection: 50%, ReversingLabs
                                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:12
                                                                                                                                                                                                                                                        Start time:07:19:23
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                        Imagebase:0x7ff620390000
                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:13
                                                                                                                                                                                                                                                        Start time:07:19:25
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\1033691001\db0740f8e4.exe"
                                                                                                                                                                                                                                                        Imagebase:0xd40000
                                                                                                                                                                                                                                                        File size:349'696 bytes
                                                                                                                                                                                                                                                        MD5 hash:6446A00EB59754E15749AF229B0D5217
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:15
                                                                                                                                                                                                                                                        Start time:07:19:25
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                        Commandline:C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1704 -ip 1704
                                                                                                                                                                                                                                                        Imagebase:0x260000
                                                                                                                                                                                                                                                        File size:483'680 bytes
                                                                                                                                                                                                                                                        MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:16
                                                                                                                                                                                                                                                        Start time:07:19:26
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                        Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 908
                                                                                                                                                                                                                                                        Imagebase:0x260000
                                                                                                                                                                                                                                                        File size:483'680 bytes
                                                                                                                                                                                                                                                        MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:17
                                                                                                                                                                                                                                                        Start time:07:19:27
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c "dxdiag /t C:\Users\user\AppData\Local\Bunny\Info.txt"
                                                                                                                                                                                                                                                        Imagebase:0x7ff725d10000
                                                                                                                                                                                                                                                        File size:289'792 bytes
                                                                                                                                                                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:18
                                                                                                                                                                                                                                                        Start time:07:19:27
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                        Imagebase:0x7ff620390000
                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Reputation:high
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:19
                                                                                                                                                                                                                                                        Start time:07:19:28
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Windows\System32\dxdiag.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                        Commandline:dxdiag /t C:\Users\user\AppData\Local\Bunny\Info.txt
                                                                                                                                                                                                                                                        Imagebase:0x7ff6f0fc0000
                                                                                                                                                                                                                                                        File size:272'384 bytes
                                                                                                                                                                                                                                                        MD5 hash:19AB5AD061BF013EBD012D0682DF37E5
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Reputation:moderate
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:21
                                                                                                                                                                                                                                                        Start time:07:19:29
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\1033693001\e0ac53ba53.exe"
                                                                                                                                                                                                                                                        Imagebase:0x820000
                                                                                                                                                                                                                                                        File size:1'883'136 bytes
                                                                                                                                                                                                                                                        MD5 hash:37E85A34D4EC7C387A79E20CE262F2CF
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000015.00000003.2211666253.0000000001253000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:22
                                                                                                                                                                                                                                                        Start time:07:19:35
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exe"
                                                                                                                                                                                                                                                        Imagebase:0xa40000
                                                                                                                                                                                                                                                        File size:3'104'256 bytes
                                                                                                                                                                                                                                                        MD5 hash:612B785A52C7C281DD891D4835E0E4CE
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000003.2299818266.0000000001418000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000003.2299582589.0000000001464000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000003.2312742082.000000000141B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                        Reputation:low
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:23
                                                                                                                                                                                                                                                        Start time:07:19:38
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Windows\System32\drivers\mstee.sys
                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                        Commandline:
                                                                                                                                                                                                                                                        Imagebase:0x7ff7dfef0000
                                                                                                                                                                                                                                                        File size:12'288 bytes
                                                                                                                                                                                                                                                        MD5 hash:244C73253E165582DDC43AF4467D23DF
                                                                                                                                                                                                                                                        Has elevated privileges:
                                                                                                                                                                                                                                                        Has administrator privileges:
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Reputation:moderate
                                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:24
                                                                                                                                                                                                                                                        Start time:07:19:38
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Windows\System32\drivers\mskssrv.sys
                                                                                                                                                                                                                                                        Wow64 process (32bit):
                                                                                                                                                                                                                                                        Commandline:
                                                                                                                                                                                                                                                        Imagebase:
                                                                                                                                                                                                                                                        File size:34'816 bytes
                                                                                                                                                                                                                                                        MD5 hash:26854C1F5500455757BC00365CEF9483
                                                                                                                                                                                                                                                        Has elevated privileges:
                                                                                                                                                                                                                                                        Has administrator privileges:
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:25
                                                                                                                                                                                                                                                        Start time:07:19:41
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe"
                                                                                                                                                                                                                                                        Imagebase:0x4e0000
                                                                                                                                                                                                                                                        File size:1'864'192 bytes
                                                                                                                                                                                                                                                        MD5 hash:8E7317BD5F12DA95C46CA94572B2C331
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                                        • Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000019.00000003.2243727892.0000000004A90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:26
                                                                                                                                                                                                                                                        Start time:07:19:46
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\1033696001\959ae18948.exe"
                                                                                                                                                                                                                                                        Imagebase:0x6e0000
                                                                                                                                                                                                                                                        File size:969'728 bytes
                                                                                                                                                                                                                                                        MD5 hash:A5F4B776FBC130947C7EA91252E30747
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:27
                                                                                                                                                                                                                                                        Start time:07:19:49
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                        Commandline:taskkill /F /IM firefox.exe /T
                                                                                                                                                                                                                                                        Imagebase:0x840000
                                                                                                                                                                                                                                                        File size:74'240 bytes
                                                                                                                                                                                                                                                        MD5 hash:CA313FD7E6C2A778FFD21CFB5C1C56CD
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:28
                                                                                                                                                                                                                                                        Start time:07:19:49
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                        Imagebase:0x7ff70fc70000
                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:29
                                                                                                                                                                                                                                                        Start time:07:19:49
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\1033694001\cf4bd6029c.exe"
                                                                                                                                                                                                                                                        Imagebase:0xa40000
                                                                                                                                                                                                                                                        File size:3'104'256 bytes
                                                                                                                                                                                                                                                        MD5 hash:612B785A52C7C281DD891D4835E0E4CE
                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:30
                                                                                                                                                                                                                                                        Start time:07:19:51
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                        Commandline:taskkill /F /IM chrome.exe /T
                                                                                                                                                                                                                                                        Imagebase:0x840000
                                                                                                                                                                                                                                                        File size:74'240 bytes
                                                                                                                                                                                                                                                        MD5 hash:CA313FD7E6C2A778FFD21CFB5C1C56CD
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:31
                                                                                                                                                                                                                                                        Start time:07:19:51
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                        Imagebase:0x880000
                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:32
                                                                                                                                                                                                                                                        Start time:07:19:51
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                        Commandline:taskkill /F /IM chrome.exe
                                                                                                                                                                                                                                                        Imagebase:0x7ff61d840000
                                                                                                                                                                                                                                                        File size:101'376 bytes
                                                                                                                                                                                                                                                        MD5 hash:A599D3B2FAFBDE4C1A6D7D0F839451C7
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:33
                                                                                                                                                                                                                                                        Start time:07:19:51
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                        Imagebase:0x7ff620390000
                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:34
                                                                                                                                                                                                                                                        Start time:07:19:51
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                        Commandline:taskkill /F /IM msedge.exe /T
                                                                                                                                                                                                                                                        Imagebase:0x840000
                                                                                                                                                                                                                                                        File size:74'240 bytes
                                                                                                                                                                                                                                                        MD5 hash:CA313FD7E6C2A778FFD21CFB5C1C56CD
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:35
                                                                                                                                                                                                                                                        Start time:07:19:51
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                        Imagebase:0x7ff620390000
                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:36
                                                                                                                                                                                                                                                        Start time:07:19:52
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
                                                                                                                                                                                                                                                        Imagebase:0x7ff6c5c30000
                                                                                                                                                                                                                                                        File size:3'242'272 bytes
                                                                                                                                                                                                                                                        MD5 hash:83395EAB5B03DEA9720F8D7AC0D15CAA
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:37
                                                                                                                                                                                                                                                        Start time:07:19:52
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                        Commandline:taskkill /F /IM opera.exe /T
                                                                                                                                                                                                                                                        Imagebase:0x840000
                                                                                                                                                                                                                                                        File size:74'240 bytes
                                                                                                                                                                                                                                                        MD5 hash:CA313FD7E6C2A778FFD21CFB5C1C56CD
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:38
                                                                                                                                                                                                                                                        Start time:07:19:52
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                        Imagebase:0x7ff620390000
                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:39
                                                                                                                                                                                                                                                        Start time:07:19:52
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9876 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                                                                                                                                                                                                                        Imagebase:0x7ff6c5c30000
                                                                                                                                                                                                                                                        File size:3'242'272 bytes
                                                                                                                                                                                                                                                        MD5 hash:83395EAB5B03DEA9720F8D7AC0D15CAA
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:40
                                                                                                                                                                                                                                                        Start time:07:19:52
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\1033697001\caf9f1bef3.exe"
                                                                                                                                                                                                                                                        Imagebase:0x3a0000
                                                                                                                                                                                                                                                        File size:2'761'216 bytes
                                                                                                                                                                                                                                                        MD5 hash:CB31FF98156630BF835768E1C1B47EE1
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:41
                                                                                                                                                                                                                                                        Start time:07:19:52
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                        Commandline:taskkill /F /IM brave.exe /T
                                                                                                                                                                                                                                                        Imagebase:0x840000
                                                                                                                                                                                                                                                        File size:74'240 bytes
                                                                                                                                                                                                                                                        MD5 hash:CA313FD7E6C2A778FFD21CFB5C1C56CD
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:42
                                                                                                                                                                                                                                                        Start time:07:19:52
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                        Imagebase:0x7ff620390000
                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:43
                                                                                                                                                                                                                                                        Start time:07:19:54
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                        Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                                                                                                                                                                                                                                                        Imagebase:0x7ff613480000
                                                                                                                                                                                                                                                        File size:676'768 bytes
                                                                                                                                                                                                                                                        MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:44
                                                                                                                                                                                                                                                        Start time:07:19:55
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                        Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
                                                                                                                                                                                                                                                        Imagebase:0x7ff613480000
                                                                                                                                                                                                                                                        File size:676'768 bytes
                                                                                                                                                                                                                                                        MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:45
                                                                                                                                                                                                                                                        Start time:07:19:55
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                        Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                                                                                                                                                                                                                                                        Imagebase:0x7ff613480000
                                                                                                                                                                                                                                                        File size:676'768 bytes
                                                                                                                                                                                                                                                        MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:47
                                                                                                                                                                                                                                                        Start time:07:19:56
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2012 --field-trial-handle=2008,i,17564928535210738890,5689791328347770168,262144 /prefetch:8
                                                                                                                                                                                                                                                        Imagebase:0x7ff6c5c30000
                                                                                                                                                                                                                                                        File size:3'242'272 bytes
                                                                                                                                                                                                                                                        MD5 hash:83395EAB5B03DEA9720F8D7AC0D15CAA
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:48
                                                                                                                                                                                                                                                        Start time:07:19:56
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Windows\System32\taskkill.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                        Commandline:taskkill /F /IM chrome.exe
                                                                                                                                                                                                                                                        Imagebase:0x7ff61d840000
                                                                                                                                                                                                                                                        File size:101'376 bytes
                                                                                                                                                                                                                                                        MD5 hash:A599D3B2FAFBDE4C1A6D7D0F839451C7
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:49
                                                                                                                                                                                                                                                        Start time:07:19:57
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                        Imagebase:0x7ff620390000
                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:50
                                                                                                                                                                                                                                                        Start time:07:19:57
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\1033695001\05c06146f2.exe"
                                                                                                                                                                                                                                                        Imagebase:0x4e0000
                                                                                                                                                                                                                                                        File size:1'864'192 bytes
                                                                                                                                                                                                                                                        MD5 hash:8E7317BD5F12DA95C46CA94572B2C331
                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Yara matches:
                                                                                                                                                                                                                                                        • Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000032.00000003.2429756005.0000000004D80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:51
                                                                                                                                                                                                                                                        Start time:07:19:58
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\1033698001\b3206cdf20.exe"
                                                                                                                                                                                                                                                        Imagebase:0x400000
                                                                                                                                                                                                                                                        File size:1'963'520 bytes
                                                                                                                                                                                                                                                        MD5 hash:B87ABAE5DCF781D2DD96D6C8FBBDE6FF
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Has exited:false

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:52
                                                                                                                                                                                                                                                        Start time:07:19:59
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9876 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
                                                                                                                                                                                                                                                        Imagebase:0x7ff6c5c30000
                                                                                                                                                                                                                                                        File size:3'242'272 bytes
                                                                                                                                                                                                                                                        MD5 hash:83395EAB5B03DEA9720F8D7AC0D15CAA
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:53
                                                                                                                                                                                                                                                        Start time:07:19:59
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                        Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2292 -parentBuildID 20230927232528 -prefsHandle 2212 -prefMapHandle 2204 -prefsLen 25358 -prefMapSize 238690 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f00215ad-1a9f-4dfa-990d-aaf96e354c4f} 7252 "\\.\pipe\gecko-crash-server-pipe.7252" 1a1d166eb10 socket
                                                                                                                                                                                                                                                        Imagebase:0x7ff613480000
                                                                                                                                                                                                                                                        File size:676'768 bytes
                                                                                                                                                                                                                                                        MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                                                                        Has elevated privileges:false
                                                                                                                                                                                                                                                        Has administrator privileges:false
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:54
                                                                                                                                                                                                                                                        Start time:07:20:01
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                        Commandline:taskkill /F /IM firefox.exe /T
                                                                                                                                                                                                                                                        Imagebase:0x840000
                                                                                                                                                                                                                                                        File size:74'240 bytes
                                                                                                                                                                                                                                                        MD5 hash:CA313FD7E6C2A778FFD21CFB5C1C56CD
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:55
                                                                                                                                                                                                                                                        Start time:07:20:01
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                        Imagebase:0x7ff620390000
                                                                                                                                                                                                                                                        File size:862'208 bytes
                                                                                                                                                                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:56
                                                                                                                                                                                                                                                        Start time:07:20:03
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                        Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=1976 --field-trial-handle=1956,i,11737153874150669047,12636588976470451220,262144 /prefetch:8
                                                                                                                                                                                                                                                        Imagebase:0x7ff6c5c30000
                                                                                                                                                                                                                                                        File size:3'242'272 bytes
                                                                                                                                                                                                                                                        MD5 hash:83395EAB5B03DEA9720F8D7AC0D15CAA
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:57
                                                                                                                                                                                                                                                        Start time:07:20:03
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Users\user\AppData\Local\Temp\1033699001\8c9c7a39f7.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):true
                                                                                                                                                                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\1033699001\8c9c7a39f7.exe"
                                                                                                                                                                                                                                                        Imagebase:0x400000
                                                                                                                                                                                                                                                        File size:1'771'008 bytes
                                                                                                                                                                                                                                                        MD5 hash:1C0FDE14F7A46816A2E8A747A90E1584
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Antivirus matches:
                                                                                                                                                                                                                                                        • Detection: 37%, ReversingLabs
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        General

                                                                                                                                                                                                                                                        Target ID:58
                                                                                                                                                                                                                                                        Start time:07:20:06
                                                                                                                                                                                                                                                        Start date:07/01/2025
                                                                                                                                                                                                                                                        Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                        Wow64 process (32bit):false
                                                                                                                                                                                                                                                        Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
                                                                                                                                                                                                                                                        Imagebase:0x7ff6a9290000
                                                                                                                                                                                                                                                        File size:4'210'216 bytes
                                                                                                                                                                                                                                                        MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                                                                                                        Has elevated privileges:true
                                                                                                                                                                                                                                                        Has administrator privileges:true
                                                                                                                                                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                        Has exited:true

                                                                                                                                                                                                                                                        Disassembly

                                                                                                                                                                                                                                                        Reset < >

                                                                                                                                                                                                                                                          Execution Graph

                                                                                                                                                                                                                                                          Execution Coverage:4.3%
                                                                                                                                                                                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                                          Signature Coverage:3.9%
                                                                                                                                                                                                                                                          Total number of Nodes:797
                                                                                                                                                                                                                                                          Total number of Limit Nodes:18
                                                                                                                                                                                                                                                          execution_graph 12805 5d9adc 12808 5d9aea shared_ptr 12805->12808 12806 5da917 12807 5da953 Sleep CreateMutexA 12806->12807 12809 5da98e 12807->12809 12808->12806 12810 5d9b4b shared_ptr 12808->12810 12811 5d5c10 6 API calls 12810->12811 12812 5d9b59 12810->12812 12813 5d9b7c 12811->12813 12820 5d8b30 12813->12820 12815 5d9b8d 12816 5d5c10 6 API calls 12815->12816 12817 5d9cb1 12816->12817 12818 5d8b30 6 API calls 12817->12818 12819 5d9cc2 12818->12819 12821 5d8b7c 12820->12821 12822 5d5c10 6 API calls 12821->12822 12823 5d8b97 shared_ptr __floor_pentium4 12822->12823 12823->12815 13154 5d3f9f 13155 5d3fad 13154->13155 13156 5d3fb6 13154->13156 13157 5d2410 5 API calls 13155->13157 13157->13156 12683 5d215a 12686 5ec6fc 12683->12686 12685 5d2164 12688 5ec70c 12686->12688 12689 5ec724 12686->12689 12688->12689 12690 5ecfbe 12688->12690 12689->12685 12691 5eccd5 __Mtx_init_in_situ InitializeCriticalSectionEx 12690->12691 12692 5ecfd0 12691->12692 12692->12688 12215 606629 12218 6064c7 12215->12218 12220 6064d5 __fassign 12218->12220 12219 606520 12220->12219 12223 60652b 12220->12223 12222 60652a 12229 60a302 GetPEB 12223->12229 12225 606535 12226 60653a GetPEB 12225->12226 12228 60654a __fassign 12225->12228 12226->12228 12227 606562 ExitProcess 12228->12227 12230 60a31c __fassign 12229->12230 12230->12225 12231 5da856 12232 5da870 12231->12232 12233 5da892 shared_ptr 12231->12233 12232->12233 12234 5da94e 12232->12234 12237 5da8a0 12233->12237 12247 5d7d30 12233->12247 12238 5da953 Sleep CreateMutexA 12234->12238 12236 5da8ae 12236->12237 12239 5d7d30 7 API calls 12236->12239 12240 5da98e 12238->12240 12241 5da8b8 12239->12241 12241->12237 12242 5d7d30 7 API calls 12241->12242 12243 5da8c2 12242->12243 12243->12237 12244 5d7d30 7 API calls 12243->12244 12245 5da8cc 12244->12245 12245->12237 12246 5d7d30 7 API calls 12245->12246 12246->12237 12248 5d7d96 __cftof 12247->12248 12285 5d7ee8 shared_ptr __floor_pentium4 12248->12285 12286 5d5c10 12248->12286 12250 5d7dd2 12251 5d5c10 6 API calls 12250->12251 12252 5d7dff shared_ptr 12251->12252 12253 5d7ed3 GetNativeSystemInfo 12252->12253 12254 5d7ed7 12252->12254 12252->12285 12253->12254 12255 5d7f3f 12254->12255 12256 5d8019 12254->12256 12254->12285 12257 5d5c10 6 API calls 12255->12257 12258 5d5c10 6 API calls 12256->12258 12259 5d7f67 12257->12259 12260 5d804c 12258->12260 12262 5d5c10 6 API calls 12259->12262 12261 5d5c10 6 API calls 12260->12261 12263 5d806b 12261->12263 12264 5d7f86 12262->12264 12266 5d5c10 6 API calls 12263->12266 12296 608bbe 12264->12296 12267 5d80a3 12266->12267 12268 5d5c10 6 API calls 12267->12268 12269 5d80f4 12268->12269 12270 5d5c10 6 API calls 12269->12270 12271 5d8113 12270->12271 12272 5d5c10 6 API calls 12271->12272 12273 5d814b 12272->12273 12274 5d5c10 6 API calls 12273->12274 12275 5d819c 12274->12275 12276 5d5c10 6 API calls 12275->12276 12277 5d81bb 12276->12277 12278 5d5c10 6 API calls 12277->12278 12279 5d81f3 12278->12279 12280 5d5c10 6 API calls 12279->12280 12281 5d8244 12280->12281 12282 5d5c10 6 API calls 12281->12282 12283 5d8263 12282->12283 12284 5d5c10 6 API calls 12283->12284 12284->12285 12285->12236 12287 5d5c54 12286->12287 12299 5d4b30 12287->12299 12289 5d5d17 shared_ptr __floor_pentium4 12289->12250 12290 5d5c7b __cftof 12290->12289 12291 5d5da7 RegOpenKeyExA 12290->12291 12292 5d5e00 RegCloseKey 12291->12292 12293 5d5e26 12292->12293 12293->12293 12294 5d5ea6 shared_ptr __floor_pentium4 12293->12294 12295 5d5c10 4 API calls 12293->12295 12294->12250 12420 608868 12296->12420 12298 608bdc 12298->12285 12301 5d4b92 12299->12301 12302 5d4ce5 12299->12302 12301->12302 12303 606da6 12301->12303 12302->12290 12304 606dc2 __fassign 12303->12304 12305 606db4 12303->12305 12304->12301 12308 606d19 12305->12308 12313 60690a 12308->12313 12312 606d3d 12312->12301 12314 60692a 12313->12314 12320 606921 12313->12320 12314->12320 12327 60a671 12314->12327 12321 606d52 12320->12321 12322 606d8f 12321->12322 12324 606d5f 12321->12324 12412 60b67d 12322->12412 12326 606d6e __fassign 12324->12326 12407 60b6a1 12324->12407 12326->12312 12328 60a67b __fassign 12327->12328 12332 60a694 __fassign ___free_lconv_mon 12328->12332 12342 60d82f 12328->12342 12330 60694a 12334 60b5fb 12330->12334 12332->12330 12346 608bec 12332->12346 12335 606960 12334->12335 12336 60b60e 12334->12336 12338 60b628 12335->12338 12336->12335 12372 60f5ab 12336->12372 12339 60b63b 12338->12339 12341 60b650 12338->12341 12339->12341 12379 60e6b1 12339->12379 12341->12320 12343 60d83c __fassign 12342->12343 12344 60d867 RtlAllocateHeap 12343->12344 12345 60d87a 12343->12345 12344->12343 12344->12345 12345->12332 12347 608bf1 __fassign 12346->12347 12350 608bfc ___std_exception_copy 12347->12350 12352 60d634 12347->12352 12366 6065ed 12350->12366 12354 60d640 __fassign 12352->12354 12353 60d69c ___std_exception_copy 12353->12350 12354->12353 12355 60d726 12354->12355 12356 60d81b __fassign 12354->12356 12358 60d751 __fassign 12354->12358 12355->12358 12369 60d62b 12355->12369 12357 6065ed __fassign 3 API calls 12356->12357 12360 60d82e 12357->12360 12358->12353 12361 60a671 __fassign 4 API calls 12358->12361 12364 60d7a5 12358->12364 12361->12364 12363 60d62b __fassign 4 API calls 12363->12358 12364->12353 12365 60a671 __fassign 4 API calls 12364->12365 12365->12353 12367 6064c7 __fassign 3 API calls 12366->12367 12368 6065fe 12367->12368 12370 60a671 __fassign GetPEB ExitProcess GetPEB RtlAllocateHeap 12369->12370 12371 60d630 12370->12371 12371->12363 12373 60f5b7 __fassign 12372->12373 12374 60a671 __fassign 4 API calls 12373->12374 12376 60f5c0 __fassign 12374->12376 12375 60f606 12375->12335 12376->12375 12377 608bec __fassign 4 API calls 12376->12377 12378 60f62b 12377->12378 12380 60a671 __fassign 4 API calls 12379->12380 12381 60e6bb 12380->12381 12384 60e5c9 12381->12384 12383 60e6c1 12383->12341 12388 60e5d5 __fassign ___free_lconv_mon 12384->12388 12385 60e5f6 12385->12383 12386 608bec __fassign 4 API calls 12387 60e668 12386->12387 12389 60e6a4 12387->12389 12393 60a72e 12387->12393 12388->12385 12388->12386 12389->12383 12394 60a739 __fassign 12393->12394 12395 60a745 __fassign ___free_lconv_mon 12394->12395 12397 60d82f __fassign RtlAllocateHeap 12394->12397 12396 608bec __fassign GetPEB ExitProcess GetPEB RtlAllocateHeap 12395->12396 12399 60a7be 12395->12399 12398 60a7c7 12396->12398 12397->12395 12400 60e4b0 12399->12400 12401 60e5c9 __fassign GetPEB ExitProcess GetPEB RtlAllocateHeap 12400->12401 12402 60e4c3 12401->12402 12403 60e259 __fassign GetPEB ExitProcess GetPEB RtlAllocateHeap 12402->12403 12404 60e4cb __fassign 12403->12404 12405 60e6c4 __fassign GetPEB ExitProcess GetPEB RtlAllocateHeap 12404->12405 12406 60e4dc __fassign ___free_lconv_mon 12404->12406 12405->12406 12406->12389 12408 60690a __fassign 4 API calls 12407->12408 12409 60b6be 12408->12409 12411 60b6ce __floor_pentium4 12409->12411 12417 60f1bf 12409->12417 12411->12326 12413 60a671 __fassign 4 API calls 12412->12413 12414 60b688 12413->12414 12415 60b5fb __fassign 4 API calls 12414->12415 12416 60b698 12415->12416 12416->12326 12418 60690a __fassign 4 API calls 12417->12418 12419 60f1df __cftof __fassign __freea __floor_pentium4 12418->12419 12419->12411 12421 60887a 12420->12421 12422 60690a __fassign 4 API calls 12421->12422 12425 60888f ___std_exception_copy 12421->12425 12424 6088bf 12422->12424 12423 606d52 4 API calls 12423->12424 12424->12423 12424->12425 12425->12298 12873 5d2b10 12874 5d2b1c 12873->12874 12875 5d2b1a 12873->12875 12876 5ec26a 5 API calls 12874->12876 12877 5d2b22 12876->12877 13158 5d2b90 13159 5d2bce 13158->13159 13160 5eb7fb TpReleaseWork 13159->13160 13161 5d2bdb shared_ptr __floor_pentium4 13160->13161 13009 5e87d0 13010 5e882a __cftof 13009->13010 13016 5e9bb0 13010->13016 13014 5e88d9 std::_Throw_future_error 13015 5e886c __floor_pentium4 13029 5e9ef0 13016->13029 13018 5e9be5 13033 5d2ce0 13018->13033 13020 5e9c16 13042 5e9f70 13020->13042 13022 5e8854 13022->13015 13023 5d43f0 13022->13023 13024 5ebedf InitOnceExecuteOnce 13023->13024 13025 5d440a 13024->13025 13026 5d4411 13025->13026 13027 606cbb 4 API calls 13025->13027 13026->13014 13028 5d4424 13027->13028 13030 5e9f0c 13029->13030 13031 5ec68b __Mtx_init_in_situ 2 API calls 13030->13031 13032 5e9f17 13031->13032 13032->13018 13034 5d2d1d 13033->13034 13035 5ebedf InitOnceExecuteOnce 13034->13035 13036 5d2d46 13035->13036 13037 5d2d88 13036->13037 13038 5d2d51 __floor_pentium4 13036->13038 13047 5ebef7 13036->13047 13040 5d2440 4 API calls 13037->13040 13038->13020 13041 5d2d9b 13040->13041 13041->13020 13043 5e9fef shared_ptr 13042->13043 13045 5ea058 13043->13045 13060 5ea210 13043->13060 13046 5ea03b 13046->13022 13048 5ebf03 std::_Throw_future_error 13047->13048 13049 5ebf6a 13048->13049 13050 5ebf73 13048->13050 13054 5ebe7f 13049->13054 13052 5d2ae0 5 API calls 13050->13052 13053 5ebf6f 13052->13053 13053->13037 13055 5ecc31 InitOnceExecuteOnce 13054->13055 13056 5ebe97 13055->13056 13057 5ebe9e 13056->13057 13058 606cbb 4 API calls 13056->13058 13057->13053 13059 5ebea7 13058->13059 13059->13053 13061 5ea290 13060->13061 13067 5e71d0 13061->13067 13063 5ea2cc shared_ptr 13064 5ea4be shared_ptr 13063->13064 13065 5d3ee0 3 API calls 13063->13065 13064->13046 13066 5ea4a6 13065->13066 13066->13046 13068 5e7211 13067->13068 13075 5d3970 13068->13075 13070 5e7446 __floor_pentium4 13070->13063 13071 5e72ad __cftof 13071->13070 13072 5ec68b __Mtx_init_in_situ 2 API calls 13071->13072 13073 5e7401 13072->13073 13080 5d2ec0 13073->13080 13076 5ec68b __Mtx_init_in_situ 2 API calls 13075->13076 13077 5d39a7 13076->13077 13078 5ec68b __Mtx_init_in_situ 2 API calls 13077->13078 13079 5d39e6 13078->13079 13079->13071 13081 5d2f7e GetCurrentThreadId 13080->13081 13082 5d2f06 13080->13082 13083 5d2f94 13081->13083 13084 5d2fef 13081->13084 13085 5ec6ac GetSystemTimePreciseAsFileTime 13082->13085 13083->13084 13090 5ec6ac GetSystemTimePreciseAsFileTime 13083->13090 13084->13070 13086 5d2f12 13085->13086 13087 5d301e 13086->13087 13093 5d2f1d __Mtx_unlock 13086->13093 13088 5ec26a 5 API calls 13087->13088 13089 5d3024 13088->13089 13091 5ec26a 5 API calls 13089->13091 13092 5d2fb9 13090->13092 13091->13092 13095 5ec26a 5 API calls 13092->13095 13096 5d2fc0 __Mtx_unlock 13092->13096 13093->13089 13094 5d2f6f 13093->13094 13094->13081 13094->13084 13095->13096 13097 5ec26a 5 API calls 13096->13097 13098 5d2fd8 __Cnd_broadcast 13096->13098 13097->13098 13098->13084 13099 5ec26a 5 API calls 13098->13099 13100 5d303c 13099->13100 13101 5ec6ac GetSystemTimePreciseAsFileTime 13100->13101 13109 5d3080 shared_ptr __Mtx_unlock 13101->13109 13102 5d31c5 13103 5ec26a 5 API calls 13102->13103 13104 5d31cb 13103->13104 13105 5ec26a 5 API calls 13104->13105 13106 5d31d1 13105->13106 13107 5ec26a 5 API calls 13106->13107 13115 5d3193 __Mtx_unlock 13107->13115 13108 5d31a7 __floor_pentium4 13108->13070 13109->13102 13109->13104 13109->13108 13111 5d3132 GetCurrentThreadId 13109->13111 13110 5ec26a 5 API calls 13112 5d31dd 13110->13112 13111->13108 13113 5d313b 13111->13113 13113->13108 13114 5ec6ac GetSystemTimePreciseAsFileTime 13113->13114 13117 5d315f 13114->13117 13115->13108 13115->13110 13116 5ebd4c GetSystemTimePreciseAsFileTime 13116->13117 13117->13102 13117->13106 13117->13115 13117->13116 12701 5ed111 12702 5ed121 12701->12702 12703 5ed12a 12702->12703 12705 5ed199 12702->12705 12706 5ed1a7 SleepConditionVariableCS 12705->12706 12708 5ed1c0 12705->12708 12706->12708 12708->12702 12626 5d3c8e 12627 5d3c98 12626->12627 12629 5d3ca5 12627->12629 12634 5d2410 12627->12634 12630 5d3ccf 12629->12630 12631 5d3810 4 API calls 12629->12631 12632 5d3810 4 API calls 12630->12632 12631->12630 12633 5d3cdb 12632->12633 12635 5d2424 12634->12635 12638 5eb52d 12635->12638 12646 603aed 12638->12646 12641 5eb5a5 ___std_exception_copy 12653 5eb1ad 12641->12653 12642 5eb598 12649 5eaf56 12642->12649 12645 5d242a 12645->12629 12657 604f29 12646->12657 12648 5eb555 12648->12641 12648->12642 12648->12645 12650 5eaf9f ___std_exception_copy 12649->12650 12652 5eafb2 shared_ptr 12650->12652 12663 5eb39f 12650->12663 12652->12645 12654 5eb1d8 12653->12654 12655 5eb1e1 shared_ptr 12653->12655 12656 5eb39f 5 API calls 12654->12656 12655->12645 12656->12655 12658 604f2e __fassign 12657->12658 12658->12648 12659 60d634 __fassign 4 API calls 12658->12659 12662 608bfc ___std_exception_copy 12658->12662 12659->12662 12660 6065ed __fassign 3 API calls 12661 608c2f 12660->12661 12662->12660 12664 5ebedf InitOnceExecuteOnce 12663->12664 12665 5eb3e1 12664->12665 12666 5eb3e8 12665->12666 12674 606cbb 12665->12674 12666->12652 12675 606cc7 __fassign 12674->12675 12676 60a671 __fassign 4 API calls 12675->12676 12677 606ccc 12676->12677 12678 608bec __fassign 4 API calls 12677->12678 12679 606cf6 12678->12679 12588 5ed0c7 12589 5ed0d7 12588->12589 12590 5ed17f 12589->12590 12591 5ed17b RtlWakeAllConditionVariable 12589->12591 12868 5d9f44 12869 5d9f4c shared_ptr 12868->12869 12870 5da953 Sleep CreateMutexA 12869->12870 12872 5da01f shared_ptr 12869->12872 12871 5da98e 12870->12871 12489 5d3c47 12490 5d3c51 12489->12490 12493 5d3c5f 12490->12493 12496 5d32d0 12490->12496 12491 5d3c68 12493->12491 12515 5d3810 12493->12515 12519 5ec6ac 12496->12519 12498 5d336b 12525 5ec26a 12498->12525 12500 5d333c __Mtx_unlock 12502 5ec26a 5 API calls 12500->12502 12504 5d3350 __floor_pentium4 12500->12504 12505 5d3377 12502->12505 12503 5d3314 12503->12498 12503->12500 12522 5ebd4c 12503->12522 12504->12493 12506 5ec6ac GetSystemTimePreciseAsFileTime 12505->12506 12507 5d33af 12506->12507 12508 5ec26a 5 API calls 12507->12508 12509 5d33b6 __Cnd_broadcast 12507->12509 12508->12509 12510 5ec26a 5 API calls 12509->12510 12511 5d33d7 __Mtx_unlock 12509->12511 12510->12511 12512 5ec26a 5 API calls 12511->12512 12513 5d33eb 12511->12513 12514 5d340e 12512->12514 12513->12493 12514->12493 12516 5d381c 12515->12516 12570 5d2440 12516->12570 12529 5ec452 12519->12529 12521 5ec6b9 12521->12503 12546 5ebb72 12522->12546 12524 5ebd5c 12524->12503 12526 5ec292 12525->12526 12527 5ec274 12525->12527 12526->12526 12527->12526 12552 5ec297 12527->12552 12530 5ec4a8 12529->12530 12532 5ec47a __floor_pentium4 12529->12532 12530->12532 12535 5ecf6b 12530->12535 12532->12521 12533 5ec4fd __Xtime_diff_to_millis2 12533->12532 12534 5ecf6b _xtime_get GetSystemTimePreciseAsFileTime 12533->12534 12534->12533 12536 5ecf7a 12535->12536 12537 5ecf87 __aulldvrm 12535->12537 12536->12537 12539 5ecf44 12536->12539 12537->12533 12542 5ecbea 12539->12542 12543 5ecbfb GetSystemTimePreciseAsFileTime 12542->12543 12545 5ecc07 12542->12545 12543->12545 12545->12537 12547 5ebb9c 12546->12547 12548 5ecf6b _xtime_get GetSystemTimePreciseAsFileTime 12547->12548 12551 5ebba4 __Xtime_diff_to_millis2 __floor_pentium4 12547->12551 12549 5ebbcf __Xtime_diff_to_millis2 12548->12549 12550 5ecf6b _xtime_get GetSystemTimePreciseAsFileTime 12549->12550 12549->12551 12550->12551 12551->12524 12555 5d2ae0 12552->12555 12554 5ec2ae std::_Throw_future_error 12563 5ebedf 12555->12563 12557 5d2af4 __fassign 12558 5d2aff 12557->12558 12559 60a671 __fassign 4 API calls 12557->12559 12558->12554 12562 606ccc 12559->12562 12560 608bec __fassign 4 API calls 12561 606cf6 12560->12561 12562->12560 12566 5ecc31 12563->12566 12567 5ecc3f InitOnceExecuteOnce 12566->12567 12569 5ebef2 12566->12569 12567->12569 12569->12557 12573 5eb5d6 12570->12573 12572 5d2472 12574 5eb5f1 std::_Throw_future_error 12573->12574 12575 608bec __fassign 4 API calls 12574->12575 12577 5eb658 __fassign __floor_pentium4 12574->12577 12576 5eb69f 12575->12576 12577->12572 12430 5d8780 12431 5d8786 12430->12431 12437 606729 12431->12437 12434 5d87a6 12436 5d87a0 12444 606672 12437->12444 12439 5d8793 12439->12434 12440 6067b7 12439->12440 12441 6067c3 __fassign 12440->12441 12443 6067cd ___std_exception_copy 12441->12443 12456 606740 12441->12456 12443->12436 12445 60667e __fassign 12444->12445 12447 606685 ___std_exception_copy 12445->12447 12448 60a8c3 12445->12448 12447->12439 12449 60a8cf __fassign 12448->12449 12452 60a967 12449->12452 12451 60a8ea 12451->12447 12454 60a98a 12452->12454 12453 60d82f __fassign RtlAllocateHeap 12455 60a9d0 ___free_lconv_mon 12453->12455 12454->12453 12454->12454 12454->12455 12455->12451 12457 606762 12456->12457 12459 60674d ___std_exception_copy ___free_lconv_mon 12456->12459 12457->12459 12460 60a038 12457->12460 12459->12443 12461 60a075 12460->12461 12462 60a050 12460->12462 12461->12459 12462->12461 12464 610439 12462->12464 12465 610445 __fassign 12464->12465 12467 61044d __dosmaperr ___std_exception_copy 12465->12467 12468 61052b 12465->12468 12467->12461 12469 61054d 12468->12469 12473 610551 __dosmaperr ___std_exception_copy 12468->12473 12469->12473 12474 6100d2 12469->12474 12473->12467 12476 6100e3 12474->12476 12475 610106 12475->12473 12478 60fcc0 12475->12478 12476->12475 12477 60a671 __fassign 4 API calls 12476->12477 12477->12475 12479 60fd0d 12478->12479 12480 60690a __fassign 4 API calls 12479->12480 12484 60fd1c __cftof __fassign 12480->12484 12481 60b67d 4 API calls 12481->12484 12482 60c719 GetPEB ExitProcess GetPEB RtlAllocateHeap __fassign 12482->12484 12483 60ffbc __floor_pentium4 12483->12473 12484->12481 12484->12482 12484->12483 12592 5d20c0 12595 5ec68b 12592->12595 12594 5d20cc 12598 5ec3d5 12595->12598 12597 5ec69b 12597->12594 12599 5ec3eb 12598->12599 12600 5ec3e1 12598->12600 12599->12597 12601 5ec3be 12600->12601 12602 5ec39e 12600->12602 12611 5ecd0a 12601->12611 12602->12599 12607 5eccd5 12602->12607 12605 5ec3d0 12605->12597 12608 5ec3b7 12607->12608 12609 5ecce3 InitializeCriticalSectionEx 12607->12609 12608->12597 12609->12608 12612 5ecd1f RtlInitializeConditionVariable 12611->12612 12612->12605 12613 5de0c0 recv 12614 5de122 recv 12613->12614 12615 5de157 recv 12614->12615 12616 5de191 12615->12616 12617 5de2b3 __floor_pentium4 12616->12617 12618 5ec6ac GetSystemTimePreciseAsFileTime 12616->12618 12619 5de2ee 12618->12619 12620 5ec26a 5 API calls 12619->12620 12621 5de358 12620->12621 12781 5d8980 12783 5d8aea 12781->12783 12784 5d89d8 shared_ptr 12781->12784 12782 5d5c10 6 API calls 12782->12784 12784->12782 12784->12783 12801 5d2e00 12802 5d2e28 12801->12802 12803 5ec68b __Mtx_init_in_situ 2 API calls 12802->12803 12804 5d2e33 12803->12804 12790 606a44 12791 606a52 12790->12791 12792 606a5c 12790->12792 12795 60698d 12792->12795 12794 606a76 ___free_lconv_mon 12796 60690a __fassign 4 API calls 12795->12796 12797 60699f 12796->12797 12797->12794 12829 5d9ab8 12831 5d9acc 12829->12831 12832 5d9b08 12831->12832 12833 5da917 12832->12833 12834 5d9b4b shared_ptr 12832->12834 12835 5da953 Sleep CreateMutexA 12833->12835 12836 5d5c10 6 API calls 12834->12836 12837 5d9b59 12834->12837 12838 5da98e 12835->12838 12839 5d9b7c 12836->12839 12840 5d8b30 6 API calls 12839->12840 12841 5d9b8d 12840->12841 12842 5d5c10 6 API calls 12841->12842 12843 5d9cb1 12842->12843 12844 5d8b30 6 API calls 12843->12844 12845 5d9cc2 12844->12845 12756 5da9f4 12767 5d9230 12756->12767 12758 5daa03 shared_ptr 12759 5d5c10 6 API calls 12758->12759 12763 5daab3 shared_ptr 12758->12763 12760 5daa65 12759->12760 12761 5d5c10 6 API calls 12760->12761 12762 5daa8d 12761->12762 12764 5d5c10 6 API calls 12762->12764 12765 5dad3c shared_ptr __floor_pentium4 12763->12765 12777 608ab6 12763->12777 12764->12763 12770 5d9284 shared_ptr 12767->12770 12768 5d5c10 6 API calls 12768->12770 12769 5d9543 shared_ptr __floor_pentium4 12769->12758 12770->12768 12775 5d944f shared_ptr 12770->12775 12771 5d5c10 6 API calls 12771->12775 12772 5d98b5 shared_ptr __floor_pentium4 12772->12758 12773 5d979f shared_ptr 12773->12772 12774 5d5c10 6 API calls 12773->12774 12776 5d9927 shared_ptr __floor_pentium4 12774->12776 12775->12769 12775->12771 12775->12773 12776->12758 12778 608ad1 12777->12778 12779 608868 4 API calls 12778->12779 12780 608adb 12779->12780 12780->12763 12798 5d4276 12799 5d2410 5 API calls 12798->12799 12800 5d427f 12799->12800 12698 5d2170 12699 5ec6fc InitializeCriticalSectionEx 12698->12699 12700 5d217a 12699->12700 12712 5d8d30 12713 5d8d80 12712->12713 12714 5d5c10 6 API calls 12713->12714 12715 5d8d9a shared_ptr __floor_pentium4 12714->12715 12846 5d42b0 12849 5d3ac0 12846->12849 12848 5d42bb shared_ptr 12850 5d3af9 12849->12850 12852 5d32d0 6 API calls 12850->12852 12853 5d3b39 __Cnd_destroy_in_situ shared_ptr __Mtx_destroy_in_situ 12850->12853 12854 5d3c38 12850->12854 12851 5d32d0 6 API calls 12856 5d3c5f 12851->12856 12852->12854 12853->12848 12854->12851 12854->12856 12855 5d3c68 12855->12848 12856->12855 12857 5d3810 4 API calls 12856->12857 12858 5d3cdb 12857->12858 13162 5d77b0 13163 5d77f1 shared_ptr 13162->13163 13164 5d5c10 6 API calls 13163->13164 13167 5d7883 shared_ptr 13163->13167 13164->13167 13165 5d5c10 6 API calls 13168 5d79e3 13165->13168 13166 5d7953 shared_ptr __floor_pentium4 13167->13165 13167->13166 13169 5d5c10 6 API calls 13168->13169 13170 5d7a15 shared_ptr 13169->13170 13171 5d5c10 6 API calls 13170->13171 13176 5d7aa5 shared_ptr __floor_pentium4 13170->13176 13172 5d7b7d 13171->13172 13173 5d5c10 6 API calls 13172->13173 13174 5d7ba0 13173->13174 13175 5d5c10 6 API calls 13174->13175 13175->13176 13177 5d87b0 13178 5d87b8 GetFileAttributesA 13177->13178 13179 5d87b6 13177->13179 13180 5d87c4 13178->13180 13179->13178 13181 5e47b0 13183 5e4eed 13181->13183 13182 5e4f59 shared_ptr __floor_pentium4 13183->13182 13184 5d7d30 7 API calls 13183->13184 13185 5e50ed 13184->13185 13220 5d8380 13185->13220 13187 5e5106 13188 5d5c10 6 API calls 13187->13188 13189 5e5155 13188->13189 13190 5d5c10 6 API calls 13189->13190 13191 5e5171 13190->13191 13226 5d9a00 13191->13226 13221 5d83e5 __cftof 13220->13221 13222 5d5c10 6 API calls 13221->13222 13223 5d8403 shared_ptr __floor_pentium4 13221->13223 13224 5d8427 13222->13224 13223->13187 13225 5d5c10 6 API calls 13224->13225 13225->13223 13227 5d9a3f 13226->13227 13228 5d5c10 6 API calls 13227->13228 13229 5d9a47 13228->13229 13230 5d8b30 6 API calls 13229->13230 13231 5d9a58 13230->13231 12485 5d87b2 12486 5d87b8 GetFileAttributesA 12485->12486 12487 5d87b6 12485->12487 12488 5d87c4 12486->12488 12487->12486 13118 5dcbea 13119 5dcbf8 shared_ptr 13118->13119 13120 5dce09 shared_ptr __floor_pentium4 13119->13120 13121 5dce31 13119->13121 13122 5d5c10 6 API calls 13119->13122 13137 5d9030 13119->13137 13123 5d5c10 6 API calls 13121->13123 13122->13119 13124 5dce9d 13123->13124 13127 5dca70 13124->13127 13128 5d7d30 7 API calls 13127->13128 13136 5dcadd 13128->13136 13129 5dce09 shared_ptr __floor_pentium4 13130 5d5c10 6 API calls 13130->13136 13131 5d9030 6 API calls 13131->13136 13132 5dce31 13133 5d5c10 6 API calls 13132->13133 13134 5dce9d 13133->13134 13135 5dca70 7 API calls 13134->13135 13136->13129 13136->13130 13136->13131 13136->13132 13138 5d9080 13137->13138 13139 5d5c10 6 API calls 13138->13139 13140 5d909a shared_ptr __floor_pentium4 13139->13140 13140->13119 13232 5d9ba5 13233 5d9ba7 13232->13233 13234 5d5c10 6 API calls 13233->13234 13235 5d9cb1 13234->13235 13236 5d8b30 6 API calls 13235->13236 13237 5d9cc2 13236->13237 12426 5db1a0 12427 5db1f2 12426->12427 12428 5db3ad CoInitialize 12427->12428 12429 5db3fa shared_ptr __floor_pentium4 12428->12429 12680 5d20a0 12681 5ec68b __Mtx_init_in_situ 2 API calls 12680->12681 12682 5d20ac 12681->12682 12716 5d4120 12717 5d416a 12716->12717 12719 5d41b2 Concurrency::details::_ContextCallback::_CallInContext __floor_pentium4 12717->12719 12720 5d3ee0 12717->12720 12721 5d3f1e 12720->12721 12722 5d3f48 12720->12722 12721->12719 12723 5d3f58 12722->12723 12726 5d2c00 12722->12726 12723->12719 12727 5d2c0e 12726->12727 12733 5eb847 12727->12733 12729 5d2c42 12730 5d2c49 12729->12730 12739 5d2c80 12729->12739 12730->12719 12732 5d2c58 std::_Throw_future_error 12734 5eb854 12733->12734 12738 5eb873 Concurrency::details::_Reschedule_chore 12733->12738 12742 5ecb77 12734->12742 12736 5eb864 12736->12738 12744 5eb81e 12736->12744 12738->12729 12750 5eb7fb 12739->12750 12741 5d2cb2 shared_ptr 12741->12732 12743 5ecb92 CreateThreadpoolWork 12742->12743 12743->12736 12745 5eb827 Concurrency::details::_Reschedule_chore 12744->12745 12748 5ecdcc 12745->12748 12747 5eb841 12747->12738 12749 5ecde1 TpPostWork 12748->12749 12749->12747 12751 5eb817 12750->12751 12752 5eb807 12750->12752 12751->12741 12752->12751 12754 5eca78 12752->12754 12755 5eca8d TpReleaseWork 12754->12755 12755->12751 12878 5daf20 12879 5daf63 12878->12879 12890 606660 12879->12890 12884 60663f 4 API calls 12885 5daf80 12884->12885 12886 60663f 4 API calls 12885->12886 12887 5daf98 __cftof 12886->12887 12896 5d55f0 12887->12896 12889 5db04e shared_ptr __floor_pentium4 12891 60a671 __fassign 4 API calls 12890->12891 12892 5daf69 12891->12892 12893 60663f 12892->12893 12894 60a671 __fassign 4 API calls 12893->12894 12895 5daf71 12894->12895 12895->12884 12897 5d5610 12896->12897 12897->12897 12899 5d5710 __floor_pentium4 12897->12899 12900 5d22c0 12897->12900 12899->12889 12903 5d2280 12900->12903 12904 5d2296 12903->12904 12907 6087f8 12904->12907 12910 607609 12907->12910 12909 5d22a4 12909->12897 12911 607649 12910->12911 12915 607631 ___std_exception_copy __floor_pentium4 12910->12915 12912 60690a __fassign 4 API calls 12911->12912 12911->12915 12913 607661 12912->12913 12916 607bc4 12913->12916 12915->12909 12918 607bd5 12916->12918 12917 607be4 ___std_exception_copy 12917->12915 12918->12917 12923 608168 12918->12923 12928 607dc2 12918->12928 12933 607de8 12918->12933 12943 607f36 12918->12943 12924 608171 12923->12924 12925 608178 12923->12925 12952 607b50 12924->12952 12925->12918 12927 608177 12927->12918 12929 607dcb 12928->12929 12930 607dd2 12928->12930 12931 607b50 4 API calls 12929->12931 12930->12918 12932 607dd1 12931->12932 12932->12918 12935 607e09 ___std_exception_copy 12933->12935 12936 607def 12933->12936 12934 607f69 12940 607f77 12934->12940 12942 607f8b 12934->12942 12960 608241 12934->12960 12935->12918 12936->12934 12936->12935 12938 607fa2 12936->12938 12936->12940 12938->12942 12956 608390 12938->12956 12940->12942 12964 6086ea 12940->12964 12942->12918 12944 607f69 12943->12944 12946 607f4f 12943->12946 12947 608241 4 API calls 12944->12947 12949 607f77 12944->12949 12951 607f8b 12944->12951 12945 607fa2 12948 608390 4 API calls 12945->12948 12945->12951 12946->12944 12946->12945 12946->12949 12947->12949 12948->12949 12950 6086ea 4 API calls 12949->12950 12949->12951 12950->12951 12951->12918 12953 607b62 12952->12953 12954 608ab6 4 API calls 12953->12954 12955 607b85 12954->12955 12955->12927 12958 6083ab 12956->12958 12957 6083dd 12957->12940 12958->12957 12968 60c88e 12958->12968 12961 60825a 12960->12961 12975 60d3c8 12961->12975 12963 60830d 12963->12940 12963->12963 12965 60875d __floor_pentium4 12964->12965 12967 608707 12964->12967 12965->12942 12966 60c88e __cftof 4 API calls 12966->12967 12967->12965 12967->12966 12971 60c733 12968->12971 12970 60c8a6 12970->12957 12972 60c743 12971->12972 12973 60690a __fassign GetPEB ExitProcess GetPEB RtlAllocateHeap 12972->12973 12974 60c748 __cftof ___std_exception_copy 12972->12974 12973->12974 12974->12970 12976 60d3d8 ___std_exception_copy 12975->12976 12978 60d3ee 12975->12978 12976->12963 12977 60d485 12981 60d4e4 12977->12981 12982 60d4ae 12977->12982 12978->12976 12978->12977 12979 60d48a 12978->12979 12988 60cbdf 12979->12988 13005 60cef8 12981->13005 12984 60d4b3 12982->12984 12985 60d4cc 12982->12985 12994 60d23e 12984->12994 13001 60d0e2 12985->13001 12989 60cbf1 12988->12989 12990 60690a __fassign GetPEB ExitProcess GetPEB RtlAllocateHeap 12989->12990 12991 60cc05 12990->12991 12992 60cef8 GetPEB ExitProcess GetPEB RtlAllocateHeap 12991->12992 12993 60cc0d __alldvrm __cftof ___std_exception_copy _strrchr 12991->12993 12992->12993 12993->12976 12995 60d26c 12994->12995 12996 60d2de 12995->12996 12998 60d2a5 12995->12998 12999 60d2b7 12995->12999 12997 60cf9a GetPEB ExitProcess GetPEB RtlAllocateHeap 12996->12997 12997->12998 12998->12976 13000 60d16d GetPEB ExitProcess GetPEB RtlAllocateHeap 12999->13000 13000->12998 13002 60d10f 13001->13002 13003 60d14e 13002->13003 13004 60d16d GetPEB ExitProcess GetPEB RtlAllocateHeap 13002->13004 13003->12976 13004->13003 13006 60cf10 13005->13006 13007 60cf9a GetPEB ExitProcess GetPEB RtlAllocateHeap 13006->13007 13008 60cf75 13006->13008 13007->13008 13008->12976 13141 5d3fe0 13142 5d4022 13141->13142 13143 5d40d2 13142->13143 13145 5d408c 13142->13145 13147 5d4035 __floor_pentium4 13142->13147 13144 5d3ee0 3 API calls 13143->13144 13144->13147 13148 5d35e0 13145->13148 13149 5d3616 13148->13149 13150 5d2ce0 5 API calls 13149->13150 13153 5d364e Concurrency::cancel_current_task shared_ptr __floor_pentium4 13149->13153 13151 5d369e 13150->13151 13152 5d2c00 3 API calls 13151->13152 13151->13153 13152->13153 13153->13147

                                                                                                                                                                                                                                                          Executed Functions

                                                                                                                                                                                                                                                          Function 0060652B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • ExitProcess.KERNEL32(?,?,0060652A,?,?,?,?,?,00607661), ref: 00606567
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: ExitProcess
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 621844428-0
                                                                                                                                                                                                                                                          • Opcode ID: 7cec5880a4759eb819b939a931c4166f03c36e16ab19d445a899e14f98107381
                                                                                                                                                                                                                                                          • Instruction ID: f981c608353aa59f8a7bf0ac943982c205680afb6db699e3fbdc3b66e4003d25
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 7cec5880a4759eb819b939a931c4166f03c36e16ab19d445a899e14f98107381
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F8E08C3018120CAECE2ABB18CC2DDCA3B2AEF52741F140808F90886362CB26DD91CA80
                                                                                                                                                                                                                                                          Function 054B0250 Relevance: 1.4, Strings: 1, Instructions: 128COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1444758838.00000000054B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_54b0000_file.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: qtQ
                                                                                                                                                                                                                                                          • API String ID: 0-693362305
                                                                                                                                                                                                                                                          • Opcode ID: ab259c09d4753e6fe476beae5645a5aa2b79c81428e60af1deae2f840993de20
                                                                                                                                                                                                                                                          • Instruction ID: f71889baf6f8e83940fcc305ed4f60840b85b4cfdca52e558ca62def28f5855d
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ab259c09d4753e6fe476beae5645a5aa2b79c81428e60af1deae2f840993de20
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E62198FB14C120BE7402C1822A1D9FB6A2FE0D26723309527F80ED5A02E2D88A1F6072
                                                                                                                                                                                                                                                          Function 005D5C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434COMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
                                                                                                                                                                                                                                                          • API String ID: 0-3963862150
                                                                                                                                                                                                                                                          • Opcode ID: b1bc3c85c680efb58f27a182a03c07fa64ad0e848c7d24b1ba9ceceb31882db7
                                                                                                                                                                                                                                                          • Instruction ID: 4aba2a8eaa3c84200f3ba250a7ed665aeeceb6cedd548ef6ba6b002e62e2aa67
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b1bc3c85c680efb58f27a182a03c07fa64ad0e848c7d24b1ba9ceceb31882db7
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 33F1D2709002599FEB28DF58CC88BDEBBBAFB44304F50459AF518A7381DB749A84CF95
                                                                                                                                                                                                                                                          Function 005D9BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140sleepsynchronizationCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 92 5d9ba5-5d9d91 call 5e7a00 call 5d5c10 call 5d8b30 call 5e8220
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • Sleep.KERNEL32(00000064), ref: 005DA963
                                                                                                                                                                                                                                                          • CreateMutexA.KERNEL32(00000000,00000000,00633254), ref: 005DA981
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: CreateMutexSleep
                                                                                                                                                                                                                                                          • String ID: T2c
                                                                                                                                                                                                                                                          • API String ID: 1464230837-2906602477
                                                                                                                                                                                                                                                          • Opcode ID: 9db08506013135bbc75ffa8db2657033a9a347d36e057a70ff5da469bc6c3292
                                                                                                                                                                                                                                                          • Instruction ID: a71ec25f1e74d479c1ddf7c48ea8e9c3e7b1efb50b821c945e0d7eee49eab023
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9db08506013135bbc75ffa8db2657033a9a347d36e057a70ff5da469bc6c3292
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3C3109717441049BFB28DB6CDC897AEBF72BBC1310F24861BE0149B3E6C7764A858B51
                                                                                                                                                                                                                                                          Function 005D9F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137sleepsynchronizationCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 114 5d9f44-5d9f64 118 5d9f66-5d9f72 114->118 119 5d9f92-5d9fae 114->119 122 5d9f88-5d9f8f call 5ed663 118->122 123 5d9f74-5d9f82 118->123 120 5d9fdc-5d9ffb 119->120 121 5d9fb0-5d9fbc 119->121 127 5d9ffd-5da009 120->127 128 5da029-5da916 call 5e80c0 120->128 125 5d9fbe-5d9fcc 121->125 126 5d9fd2-5d9fd9 call 5ed663 121->126 122->119 123->122 129 5da92b 123->129 125->126 125->129 126->120 134 5da01f-5da026 call 5ed663 127->134 135 5da00b-5da019 127->135 131 5da953-5da994 Sleep CreateMutexA 129->131 132 5da92b call 606c6a 129->132 143 5da9a7-5da9a8 131->143 144 5da996-5da998 131->144 132->131 134->128 135->129 135->134 144->143 146 5da99a-5da9a5 144->146 146->143
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • Sleep.KERNEL32(00000064), ref: 005DA963
                                                                                                                                                                                                                                                          • CreateMutexA.KERNEL32(00000000,00000000,00633254), ref: 005DA981
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: CreateMutexSleep
                                                                                                                                                                                                                                                          • String ID: T2c
                                                                                                                                                                                                                                                          • API String ID: 1464230837-2906602477
                                                                                                                                                                                                                                                          • Opcode ID: 0bf8ac26cef56294c780de9904d326693b030fa16c3974297de83e44d8e59574
                                                                                                                                                                                                                                                          • Instruction ID: 00b73a193fd6e1869056987553dfeb95df20ff67181b40027b14fa4c725b4262
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0bf8ac26cef56294c780de9904d326693b030fa16c3974297de83e44d8e59574
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 993113717001059BEB28DB6DD88C7AEBF62BBC5310F20461BE018DB3D6D7768A808B52
                                                                                                                                                                                                                                                          Function 005DA079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136sleepsynchronizationCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 148 5da079-5da099 152 5da09b-5da0a7 148->152 153 5da0c7-5da0e3 148->153 154 5da0bd-5da0c4 call 5ed663 152->154 155 5da0a9-5da0b7 152->155 156 5da0e5-5da0f1 153->156 157 5da111-5da130 153->157 154->153 155->154 160 5da930 155->160 162 5da107-5da10e call 5ed663 156->162 163 5da0f3-5da101 156->163 158 5da15e-5da916 call 5e80c0 157->158 159 5da132-5da13e 157->159 165 5da154-5da15b call 5ed663 159->165 166 5da140-5da14e 159->166 169 5da953-5da994 Sleep CreateMutexA 160->169 170 5da930 call 606c6a 160->170 162->157 163->160 163->162 165->158 166->160 166->165 177 5da9a7-5da9a8 169->177 178 5da996-5da998 169->178 170->169 178->177 180 5da99a-5da9a5 178->180 180->177
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • Sleep.KERNEL32(00000064), ref: 005DA963
                                                                                                                                                                                                                                                          • CreateMutexA.KERNEL32(00000000,00000000,00633254), ref: 005DA981
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: CreateMutexSleep
                                                                                                                                                                                                                                                          • String ID: T2c
                                                                                                                                                                                                                                                          • API String ID: 1464230837-2906602477
                                                                                                                                                                                                                                                          • Opcode ID: 90c91f47ae0f548644c3cbe0d9b2815990f8471a3212491cda06c7c662210acf
                                                                                                                                                                                                                                                          • Instruction ID: dae7ff5bcbe4443e6b5c103d95c943d960302bb11520630ad1b75c01f728ad3e
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 90c91f47ae0f548644c3cbe0d9b2815990f8471a3212491cda06c7c662210acf
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0C31E2317401449BEB28DBACDC8DBAEBF72BBC5310F24461BE0149B3D6C77699848B52
                                                                                                                                                                                                                                                          Function 005DA1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135sleepsynchronizationCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 182 5da1ae-5da1ce 186 5da1fc-5da218 182->186 187 5da1d0-5da1dc 182->187 188 5da21a-5da226 186->188 189 5da246-5da265 186->189 190 5da1de-5da1ec 187->190 191 5da1f2-5da1f9 call 5ed663 187->191 192 5da23c-5da243 call 5ed663 188->192 193 5da228-5da236 188->193 194 5da267-5da273 189->194 195 5da293-5da916 call 5e80c0 189->195 190->191 196 5da935 190->196 191->186 192->189 193->192 193->196 201 5da289-5da290 call 5ed663 194->201 202 5da275-5da283 194->202 198 5da953-5da994 Sleep CreateMutexA 196->198 199 5da935 call 606c6a 196->199 211 5da9a7-5da9a8 198->211 212 5da996-5da998 198->212 199->198 201->195 202->196 202->201 212->211 214 5da99a-5da9a5 212->214 214->211
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • Sleep.KERNEL32(00000064), ref: 005DA963
                                                                                                                                                                                                                                                          • CreateMutexA.KERNEL32(00000000,00000000,00633254), ref: 005DA981
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: CreateMutexSleep
                                                                                                                                                                                                                                                          • String ID: T2c
                                                                                                                                                                                                                                                          • API String ID: 1464230837-2906602477
                                                                                                                                                                                                                                                          • Opcode ID: 6cec7f8f47ded619c7686a9177db89a10a48f6a2c2842c7f43a487963077fe4e
                                                                                                                                                                                                                                                          • Instruction ID: adefe222b68c61c5110928ea051a94ef16f1d2f8546f6a876ee727abc5a1af28
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6cec7f8f47ded619c7686a9177db89a10a48f6a2c2842c7f43a487963077fe4e
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5B31F3316401409BFB28DBADDC8976EBB62BB86310F24461BE0149B3D5C7769A808B52
                                                                                                                                                                                                                                                          Function 005DA418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133sleepsynchronizationCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 216 5da418-5da438 220 5da43a-5da446 216->220 221 5da466-5da482 216->221 224 5da45c-5da463 call 5ed663 220->224 225 5da448-5da456 220->225 222 5da484-5da490 221->222 223 5da4b0-5da4cf 221->223 226 5da4a6-5da4ad call 5ed663 222->226 227 5da492-5da4a0 222->227 228 5da4fd-5da916 call 5e80c0 223->228 229 5da4d1-5da4dd 223->229 224->221 225->224 230 5da93f-5da949 call 606c6a * 2 225->230 226->223 227->226 227->230 233 5da4df-5da4ed 229->233 234 5da4f3-5da4fa call 5ed663 229->234 247 5da94e-5da994 call 606c6a Sleep CreateMutexA 230->247 248 5da949 call 606c6a 230->248 233->230 233->234 234->228 252 5da9a7-5da9a8 247->252 253 5da996-5da998 247->253 248->247 253->252 254 5da99a-5da9a5 253->254 254->252
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • Sleep.KERNEL32(00000064), ref: 005DA963
                                                                                                                                                                                                                                                          • CreateMutexA.KERNEL32(00000000,00000000,00633254), ref: 005DA981
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: CreateMutexSleep
                                                                                                                                                                                                                                                          • String ID: T2c
                                                                                                                                                                                                                                                          • API String ID: 1464230837-2906602477
                                                                                                                                                                                                                                                          • Opcode ID: cc27cc8e7dca3d2d38e9cdb5ea215352964824f090e3c2f2aeee84e38c39724d
                                                                                                                                                                                                                                                          • Instruction ID: 3b33a3a96a1139c1984a949ce96b55ba3b502d31227d94c0bfdfc2e71e3e6aae
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: cc27cc8e7dca3d2d38e9cdb5ea215352964824f090e3c2f2aeee84e38c39724d
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: ED3106317401009BFB28DB7CD88DBAEBB72BBC1314F24461BE0549B3D6D7B549808B56
                                                                                                                                                                                                                                                          Function 005DA54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132sleepsynchronizationCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 256 5da54d-5da56d 260 5da56f-5da57b 256->260 261 5da59b-5da5b7 256->261 262 5da57d-5da58b 260->262 263 5da591-5da598 call 5ed663 260->263 264 5da5b9-5da5c5 261->264 265 5da5e5-5da604 261->265 262->263 268 5da944-5da949 call 606c6a 262->268 263->261 270 5da5db-5da5e2 call 5ed663 264->270 271 5da5c7-5da5d5 264->271 266 5da606-5da612 265->266 267 5da632-5da916 call 5e80c0 265->267 274 5da628-5da62f call 5ed663 266->274 275 5da614-5da622 266->275 282 5da94e-5da994 call 606c6a Sleep CreateMutexA 268->282 283 5da949 call 606c6a 268->283 270->265 271->268 271->270 274->267 275->268 275->274 290 5da9a7-5da9a8 282->290 291 5da996-5da998 282->291 283->282 291->290 292 5da99a-5da9a5 291->292 292->290
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • Sleep.KERNEL32(00000064), ref: 005DA963
                                                                                                                                                                                                                                                          • CreateMutexA.KERNEL32(00000000,00000000,00633254), ref: 005DA981
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: CreateMutexSleep
                                                                                                                                                                                                                                                          • String ID: T2c
                                                                                                                                                                                                                                                          • API String ID: 1464230837-2906602477
                                                                                                                                                                                                                                                          • Opcode ID: 8d8f8b4128579f823b0a794d5a5a9c5685000152219b20227b1c4164c2669306
                                                                                                                                                                                                                                                          • Instruction ID: d20e37f142827bfc62750a5ed64b6635afcf4b90a23f95fb7b599f0afa1d8b5d
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8d8f8b4128579f823b0a794d5a5a9c5685000152219b20227b1c4164c2669306
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5E311531B401048BFB28DB7CDC89BAEBF62BBC5314F24461BE0549B3D6C77589818B56
                                                                                                                                                                                                                                                          Function 005DA682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131sleepsynchronizationCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 294 5da682-5da6a2 298 5da6a4-5da6b0 294->298 299 5da6d0-5da6ec 294->299 300 5da6c6-5da6cd call 5ed663 298->300 301 5da6b2-5da6c0 298->301 302 5da6ee-5da6fa 299->302 303 5da71a-5da739 299->303 300->299 301->300 304 5da949 301->304 306 5da6fc-5da70a 302->306 307 5da710-5da717 call 5ed663 302->307 308 5da73b-5da747 303->308 309 5da767-5da916 call 5e80c0 303->309 311 5da94e-5da994 call 606c6a Sleep CreateMutexA 304->311 312 5da949 call 606c6a 304->312 306->304 306->307 307->303 315 5da75d-5da764 call 5ed663 308->315 316 5da749-5da757 308->316 326 5da9a7-5da9a8 311->326 327 5da996-5da998 311->327 312->311 315->309 316->304 316->315 327->326 328 5da99a-5da9a5 327->328 328->326
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • Sleep.KERNEL32(00000064), ref: 005DA963
                                                                                                                                                                                                                                                          • CreateMutexA.KERNEL32(00000000,00000000,00633254), ref: 005DA981
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: CreateMutexSleep
                                                                                                                                                                                                                                                          • String ID: T2c
                                                                                                                                                                                                                                                          • API String ID: 1464230837-2906602477
                                                                                                                                                                                                                                                          • Opcode ID: d08d0277759f651c6fbef845b2184b12d23a9d50337e6b0ca0d7867a5cbd68b7
                                                                                                                                                                                                                                                          • Instruction ID: d56f63a1c91816ab84e51827c171aa78778f52b4dcda023979f9bd935d9426f7
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d08d0277759f651c6fbef845b2184b12d23a9d50337e6b0ca0d7867a5cbd68b7
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5931E431A401449BEB28DB7CDC8976EBF72FBC1310F24461BE0549B3D6C77589808A56
                                                                                                                                                                                                                                                          Function 005D9ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107sleepsynchronizationCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 330 5d9adc-5d9ae8 331 5d9afe-5d9b27 call 5ed663 330->331 332 5d9aea-5d9af8 330->332 340 5d9b29-5d9b35 331->340 341 5d9b55-5d9b57 331->341 332->331 333 5da917 332->333 335 5da953-5da994 Sleep CreateMutexA 333->335 336 5da917 call 606c6a 333->336 342 5da9a7-5da9a8 335->342 343 5da996-5da998 335->343 336->335 344 5d9b4b-5d9b52 call 5ed663 340->344 345 5d9b37-5d9b45 340->345 346 5d9b59-5da916 call 5e80c0 341->346 347 5d9b65-5d9d91 call 5e7a00 call 5d5c10 call 5d8b30 call 5e8220 call 5e7a00 call 5d5c10 call 5d8b30 call 5e8220 341->347 343->342 349 5da99a-5da9a5 343->349 344->341 345->333 345->344 349->342
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • Sleep.KERNEL32(00000064), ref: 005DA963
                                                                                                                                                                                                                                                          • CreateMutexA.KERNEL32(00000000,00000000,00633254), ref: 005DA981
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: CreateMutexSleep
                                                                                                                                                                                                                                                          • String ID: T2c
                                                                                                                                                                                                                                                          • API String ID: 1464230837-2906602477
                                                                                                                                                                                                                                                          • Opcode ID: c27203cea54ac4f19439141f1f2ee380909acbb808f067a89d0ea134f1b89167
                                                                                                                                                                                                                                                          • Instruction ID: 5dfe82b865070cdba8085c9eb8d58e89a6bd091d56a29716007afa27546f48fa
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c27203cea54ac4f19439141f1f2ee380909acbb808f067a89d0ea134f1b89167
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: FD2125317442409BFB289B6DEC8976EBB62FBC1310F20421BF4589B3D5CB769A918B51
                                                                                                                                                                                                                                                          Function 005DA856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100sleepsynchronizationCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 407 5da856-5da86e 408 5da89c-5da89e 407->408 409 5da870-5da87c 407->409 412 5da8a9-5da8b1 call 5d7d30 408->412 413 5da8a0-5da8a7 408->413 410 5da87e-5da88c 409->410 411 5da892-5da899 call 5ed663 409->411 410->411 414 5da94e-5da987 call 606c6a Sleep CreateMutexA 410->414 411->408 423 5da8e4-5da8e6 412->423 424 5da8b3-5da8bb call 5d7d30 412->424 416 5da8eb-5da916 call 5e80c0 413->416 427 5da98e-5da994 414->427 423->416 424->423 431 5da8bd-5da8c5 call 5d7d30 424->431 429 5da9a7-5da9a8 427->429 430 5da996-5da998 427->430 430->429 432 5da99a-5da9a5 430->432 431->423 435 5da8c7-5da8cf call 5d7d30 431->435 432->429 435->423 439 5da8d1-5da8d9 call 5d7d30 435->439 439->423 442 5da8db-5da8e2 439->442 442->416
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • Sleep.KERNEL32(00000064), ref: 005DA963
                                                                                                                                                                                                                                                          • CreateMutexA.KERNEL32(00000000,00000000,00633254), ref: 005DA981
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: CreateMutexSleep
                                                                                                                                                                                                                                                          • String ID: T2c
                                                                                                                                                                                                                                                          • API String ID: 1464230837-2906602477
                                                                                                                                                                                                                                                          • Opcode ID: f74cbd0366e8997ee504f443bcaf681ad419fa8af3829ad57dfcf7bf306f5a24
                                                                                                                                                                                                                                                          • Instruction ID: f1df98fcfd81caa7cbe157f2a69ff3d8895627b502bc8e0475227286d77a95e0
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f74cbd0366e8997ee504f443bcaf681ad419fa8af3829ad57dfcf7bf306f5a24
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A12108313451059AF738A76D9C9E76FBE53FFC1300F24081BE948973D2DB664A819693
                                                                                                                                                                                                                                                          Function 005DA34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100sleepsynchronizationCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 384 5da34f-5da35b 385 5da35d-5da36b 384->385 386 5da371-5da39a call 5ed663 384->386 385->386 387 5da93a 385->387 392 5da39c-5da3a8 386->392 393 5da3c8-5da916 call 5e80c0 386->393 389 5da953-5da994 Sleep CreateMutexA 387->389 390 5da93a call 606c6a 387->390 398 5da9a7-5da9a8 389->398 399 5da996-5da998 389->399 390->389 396 5da3be-5da3c5 call 5ed663 392->396 397 5da3aa-5da3b8 392->397 396->393 397->387 397->396 399->398 402 5da99a-5da9a5 399->402 402->398
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • Sleep.KERNEL32(00000064), ref: 005DA963
                                                                                                                                                                                                                                                          • CreateMutexA.KERNEL32(00000000,00000000,00633254), ref: 005DA981
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: CreateMutexSleep
                                                                                                                                                                                                                                                          • String ID: T2c
                                                                                                                                                                                                                                                          • API String ID: 1464230837-2906602477
                                                                                                                                                                                                                                                          • Opcode ID: 5c8114523f7ad98b0b902cd005c38200e3783263ac4da6b0252e60660abdf8a9
                                                                                                                                                                                                                                                          • Instruction ID: e74b6db8ff45d48901d7c16da228f5c4e700cc0eeee85d4e7911f7575be994e8
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5c8114523f7ad98b0b902cd005c38200e3783263ac4da6b0252e60660abdf8a9
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D02145313442009BFB28DB2DDC8976EBF62FBD1310F244A1BE4089B3D5CB7696808B52
                                                                                                                                                                                                                                                          Function 005D7D30 Relevance: 1.9, APIs: 1, Instructions: 426COMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 570 5d7d30-5d7db2 call 6040f0 574 5d7db8-5d7de0 call 5e7a00 call 5d5c10 570->574 575 5d8356-5d8373 call 5ecff1 570->575 582 5d7de4-5d7e06 call 5e7a00 call 5d5c10 574->582 583 5d7de2 574->583 588 5d7e08 582->588 589 5d7e0a-5d7e23 582->589 583->582 588->589 592 5d7e25-5d7e34 589->592 593 5d7e54-5d7e7f 589->593 596 5d7e4a-5d7e51 call 5ed663 592->596 597 5d7e36-5d7e44 592->597 594 5d7e81-5d7e90 593->594 595 5d7eb0-5d7ed1 593->595 598 5d7ea6-5d7ead call 5ed663 594->598 599 5d7e92-5d7ea0 594->599 600 5d7ed7-5d7edc 595->600 601 5d7ed3-5d7ed5 GetNativeSystemInfo 595->601 596->593 597->596 602 5d8374 call 606c6a 597->602 598->595 599->598 599->602 605 5d7edd-5d7ee6 600->605 601->605 608 5d8379-5d837f call 606c6a 602->608 611 5d7ee8-5d7eef 605->611 612 5d7f04-5d7f07 605->612 614 5d7ef5-5d7eff 611->614 615 5d8351 611->615 616 5d7f0d-5d7f16 612->616 617 5d82f7-5d82fa 612->617 622 5d834c 614->622 615->575 618 5d7f29-5d7f2c 616->618 619 5d7f18-5d7f24 616->619 617->615 620 5d82fc-5d8305 617->620 623 5d82d4-5d82d6 618->623 624 5d7f32-5d7f39 618->624 619->622 625 5d832c-5d832f 620->625 626 5d8307-5d830b 620->626 622->615 633 5d82d8-5d82e2 623->633 634 5d82e4-5d82e7 623->634 627 5d7f3f-5d7f9b call 5e7a00 call 5d5c10 call 5e7a00 call 5d5c10 call 5d5d50 624->627 628 5d8019-5d82bd call 5e7a00 call 5d5c10 call 5e7a00 call 5d5c10 call 5d5d50 call 5e7a00 call 5d5c10 call 5d5730 call 5e7a00 call 5d5c10 call 5e7a00 call 5d5c10 call 5d5d50 call 5e7a00 call 5d5c10 call 5d5730 call 5e7a00 call 5d5c10 call 5e7a00 call 5d5c10 call 5d5d50 call 5e7a00 call 5d5c10 call 5d5730 call 5e7a00 call 5d5c10 call 5e7a00 call 5d5c10 call 5d5d50 call 5e7a00 call 5d5c10 call 5d5730 624->628 631 5d833d-5d8349 625->631 632 5d8331-5d833b 625->632 629 5d830d-5d8312 626->629 630 5d8320-5d832a 626->630 656 5d7fa0-5d7fa7 627->656 670 5d82c3-5d82cc 628->670 629->630 636 5d8314-5d831e 629->636 630->615 631->622 632->615 633->622 634->615 638 5d82e9-5d82f5 634->638 636->615 638->622 658 5d7fa9 656->658 659 5d7fab-5d7fcb call 608bbe 656->659 658->659 664 5d7fcd-5d7fdc 659->664 665 5d8002-5d8004 659->665 667 5d7fde-5d7fec 664->667 668 5d7ff2-5d7fff call 5ed663 664->668 669 5d800a-5d8014 665->669 665->670 667->608 667->668 668->665 669->670 670->617 674 5d82ce 670->674 674->623
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 005D7ED3
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: InfoNativeSystem
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 1721193555-0
                                                                                                                                                                                                                                                          • Opcode ID: 81fee5d9f1850998db6bcaf56b2878a92d8818833ad6cf6543d58e4c07ad6f32
                                                                                                                                                                                                                                                          • Instruction ID: bbfee7e3d5372c55b4b5e8befc513694b52131dca02b111b4edad66a30eef07c
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 81fee5d9f1850998db6bcaf56b2878a92d8818833ad6cf6543d58e4c07ad6f32
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 98E10770E006459BDB24BB2CCC1B7AD7F62BB85720F94469EE415673C2EB354E9487C2
                                                                                                                                                                                                                                                          Function 0060D82F Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 869 60d82f-60d83a 870 60d848-60d84e 869->870 871 60d83c-60d846 869->871 873 60d850-60d851 870->873 874 60d867-60d878 RtlAllocateHeap 870->874 871->870 872 60d87c-60d887 call 6075f6 871->872 879 60d889-60d88b 872->879 873->874 875 60d853-60d85a call 609dc0 874->875 876 60d87a 874->876 875->872 882 60d85c-60d865 call 608e36 875->882 876->879 882->872 882->874
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0060A813,00000001,00000364,00000006,000000FF,?,0060EE3F,?,00000004,00000000,?,?), ref: 0060D870
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: AllocateHeap
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 1279760036-0
                                                                                                                                                                                                                                                          • Opcode ID: 09a9f95b178c0703d6a02fa7f136e80dce1ca7b67894551c7ecb09f063b08267
                                                                                                                                                                                                                                                          • Instruction ID: 95881af5148df6f9f63cb63651649582e1119216bc08efd49a4d03404864c0e4
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 09a9f95b178c0703d6a02fa7f136e80dce1ca7b67894551c7ecb09f063b08267
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 71F0E9326C512476DB2D6AF29C01A9B375B9F41770B15C225EC04A72D1DA20DC0085E4
                                                                                                                                                                                                                                                          Function 005D87B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • GetFileAttributesA.KERNEL32(?,005DDA1D,?,?,?,?), ref: 005D87B9
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: AttributesFile
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 3188754299-0
                                                                                                                                                                                                                                                          • Opcode ID: fa7aece4215df6c65908296609fc973489b436b414086a202b5a2583a0c3927e
                                                                                                                                                                                                                                                          • Instruction ID: 8877b5f1540b063cc7bbaea91aee058174c6c9d04e0ce0dc0ebf43dbbbd0bfb1
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: fa7aece4215df6c65908296609fc973489b436b414086a202b5a2583a0c3927e
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 43C08C2801160005FD3C553C00888F93745E9477A43F91B8BE0748F3E2CA37682B9610
                                                                                                                                                                                                                                                          Function 005D87B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • GetFileAttributesA.KERNEL32(?,005DDA1D,?,?,?,?), ref: 005D87B9
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: AttributesFile
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 3188754299-0
                                                                                                                                                                                                                                                          • Opcode ID: 74ee86add2c293be459502e4f0ba79860b2a71d7bec899dea55a3ca86179e178
                                                                                                                                                                                                                                                          • Instruction ID: e37f2f877a1601e7ae747bf98bc220adc920b0d06731cf52573b93ddec0ac10f
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 74ee86add2c293be459502e4f0ba79860b2a71d7bec899dea55a3ca86179e178
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D6C08C3801120046FA3C9A3C40888B93A15FA037293F50B8FE0318F3E2CB33D427CAA0
                                                                                                                                                                                                                                                          Function 005DB1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 005DB3C8
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: Initialize
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 2538663250-0
                                                                                                                                                                                                                                                          • Opcode ID: f6be41ed913360a91efeef138c9e76c13b13cdd1fe1b71b7872cc20e45286c70
                                                                                                                                                                                                                                                          • Instruction ID: a1cb86c38672a601f280116d1e363ed02b0e30de385bdfe326553daf6a8f17b0
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f6be41ed913360a91efeef138c9e76c13b13cdd1fe1b71b7872cc20e45286c70
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 77B11670A10268DFEB28CF18C898BDEBBB5FF59304F5045D9E40967281D775AA88CF90
                                                                                                                                                                                                                                                          Function 054B029E Relevance: 1.4, Strings: 1, Instructions: 143COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1444758838.00000000054B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_54b0000_file.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: qtQ
                                                                                                                                                                                                                                                          • API String ID: 0-693362305
                                                                                                                                                                                                                                                          • Opcode ID: bc9de8da2ad69eb298226a26d486d06f2204a6d4613b99d8e5766783a9d7290f
                                                                                                                                                                                                                                                          • Instruction ID: 1ceea93a4a40516c8c043ba8aa96b322f5e56e4844667218c95924d27c11d9fd
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bc9de8da2ad69eb298226a26d486d06f2204a6d4613b99d8e5766783a9d7290f
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AF219EFB58C120BEB506D1916B5CAF76B2FE5C26723309527F80AD5906E2C84E5F6071
                                                                                                                                                                                                                                                          Function 054B025B Relevance: 1.4, Strings: 1, Instructions: 141COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1444758838.00000000054B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_54b0000_file.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: qtQ
                                                                                                                                                                                                                                                          • API String ID: 0-693362305
                                                                                                                                                                                                                                                          • Opcode ID: 62debad78372911671e7bb17fa6da15b64ac112179a6d9c31dcc784ff2b17c4d
                                                                                                                                                                                                                                                          • Instruction ID: 6321ade01fb55d5454b8dc7ac025fcc9dde0121599e49a5f192d7985922cd503
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 62debad78372911671e7bb17fa6da15b64ac112179a6d9c31dcc784ff2b17c4d
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2421A0FB14C110BEB502D1916B5DAFB6B2FE6D36713309527F80BD5906E2C48A5F2071
                                                                                                                                                                                                                                                          Function 054B0290 Relevance: 1.4, Strings: 1, Instructions: 119COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1444758838.00000000054B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_54b0000_file.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: qtQ
                                                                                                                                                                                                                                                          • API String ID: 0-693362305
                                                                                                                                                                                                                                                          • Opcode ID: 59a51db8b019c28127a11adab12a2b050f41edbf322a218944cb5f01d179b655
                                                                                                                                                                                                                                                          • Instruction ID: 44e5dccc0a70317c8064cf40073ae83752295478d5eddd50502c338b098bc8fb
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 59a51db8b019c28127a11adab12a2b050f41edbf322a218944cb5f01d179b655
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2C219AFB18C121BEB502D5826B5CDFB6A2FE0C36713309527F80AD5902E2C88A4F6132
                                                                                                                                                                                                                                                          Function 054B02B6 Relevance: 1.4, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1444758838.00000000054B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_54b0000_file.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: qtQ
                                                                                                                                                                                                                                                          • API String ID: 0-693362305
                                                                                                                                                                                                                                                          • Opcode ID: b7beeaa11797cbbce5c0cfa2b0ec08ea70c63b4387eebc011fb3231b6f1dae53
                                                                                                                                                                                                                                                          • Instruction ID: 30526776198583dfc8f5f6351be323b3d2d79edb3984bd6ba545b10bab66a722
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b7beeaa11797cbbce5c0cfa2b0ec08ea70c63b4387eebc011fb3231b6f1dae53
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8A118CFB24D114BEB502D5912A5DEFB6B2FE4C26723349977F80AD5902E2C84A4F6132
                                                                                                                                                                                                                                                          Function 054B0352 Relevance: 1.3, Strings: 1, Instructions: 92COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1444758838.00000000054B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_54b0000_file.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: qtQ
                                                                                                                                                                                                                                                          • API String ID: 0-693362305
                                                                                                                                                                                                                                                          • Opcode ID: 02644ab5a40707dfc3d346a404e1bfa40090b5c3b807b5dfaaa54f99bb0b9992
                                                                                                                                                                                                                                                          • Instruction ID: 888b6c301d664697b4705591fdd314a1f1d48221632e442d4d74b8042495d1f1
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 02644ab5a40707dfc3d346a404e1bfa40090b5c3b807b5dfaaa54f99bb0b9992
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2B21BB7354C6509FFB02D1A0018D9F77F677947133334669BE04E99903E6C8484B9273
                                                                                                                                                                                                                                                          Function 054B02FB Relevance: 1.3, Strings: 1, Instructions: 73COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1444758838.00000000054B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_54b0000_file.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: qtQ
                                                                                                                                                                                                                                                          • API String ID: 0-693362305
                                                                                                                                                                                                                                                          • Opcode ID: 431849f96ad8805d405d14024320d2107944915c0bcc23a4607037dd89852ee8
                                                                                                                                                                                                                                                          • Instruction ID: 9eab21dda05be1fe9a4506deb3cd3fdeac63915a6c0944b82f98a3efc50a7814
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 431849f96ad8805d405d14024320d2107944915c0bcc23a4607037dd89852ee8
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8E0126BA04C114FFB642D9915A4C9FB3B2BA583272730966BF40E95902E3D48A0F9271
                                                                                                                                                                                                                                                          Function 054B030F Relevance: 1.3, Strings: 1, Instructions: 70COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1444758838.00000000054B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_54b0000_file.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: qtQ
                                                                                                                                                                                                                                                          • API String ID: 0-693362305
                                                                                                                                                                                                                                                          • Opcode ID: 1a2d43cf64b9dd9ad236c953433659dc1816e7ca6bc3d79ba169773c0aaf89f9
                                                                                                                                                                                                                                                          • Instruction ID: eb09b76f9cee328dcbe027749e9c25d5fe8c47528279ca85af0f8544f1fb2353
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1a2d43cf64b9dd9ad236c953433659dc1816e7ca6bc3d79ba169773c0aaf89f9
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F40128BB04C110FFB601D5D15A4C9F76A2BB4876723309627F40E95A02E2D48B1B6131
                                                                                                                                                                                                                                                          Function 054B0317 Relevance: 1.3, Strings: 1, Instructions: 67COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1444758838.00000000054B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_54b0000_file.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: qtQ
                                                                                                                                                                                                                                                          • API String ID: 0-693362305
                                                                                                                                                                                                                                                          • Opcode ID: 8160c3931033f40e28985caa2ec8856c85a1f05964757e7202fda2982e4ccc7e
                                                                                                                                                                                                                                                          • Instruction ID: de365d4fcb2973780e6954947ea63f42759f21827f52e4e2d412a4ef75fd547b
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8160c3931033f40e28985caa2ec8856c85a1f05964757e7202fda2982e4ccc7e
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B20124BB14C111FFB502D6915A4C8F76A3BA4832723349A23F40E95902E7D88A1BA232
                                                                                                                                                                                                                                                          Function 054B0333 Relevance: 1.3, Strings: 1, Instructions: 67COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1444758838.00000000054B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_54b0000_file.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: qtQ
                                                                                                                                                                                                                                                          • API String ID: 0-693362305
                                                                                                                                                                                                                                                          • Opcode ID: d7da57b835af4e3867cc2b2fef1d80632bb9af43c83462d6904d711309e4ed4d
                                                                                                                                                                                                                                                          • Instruction ID: 50bdcc8a0dd5ae89a288a416ce753622dec695fd09ae28aff84e340d71b43443
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d7da57b835af4e3867cc2b2fef1d80632bb9af43c83462d6904d711309e4ed4d
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: BB01F2BB04D111BF7502D5915A4D9FB7A2BA5832723308623F40E95902E7D44A5BA132
                                                                                                                                                                                                                                                          Function 054B03D3 Relevance: 1.3, Strings: 1, Instructions: 48COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1444758838.00000000054B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_54b0000_file.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: qtQ
                                                                                                                                                                                                                                                          • API String ID: 0-693362305
                                                                                                                                                                                                                                                          • Opcode ID: 6fad30ca60d9429ce41ae5afd645dc6de6d5aae94162846d2e84f637189c967d
                                                                                                                                                                                                                                                          • Instruction ID: a9d6ddab57afb93ad023275b7764907f41c30a389957a5b318c1d956a5ebfa47
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6fad30ca60d9429ce41ae5afd645dc6de6d5aae94162846d2e84f637189c967d
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9DF024B71D8221EFB543D5E5414D8F76A2724431B3330AA63F05F89E02E7C4450BA133

                                                                                                                                                                                                                                                          Non-executed Functions

                                                                                                                                                                                                                                                          Function 006131A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: __floor_pentium4
                                                                                                                                                                                                                                                          • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                                                                                                                          • API String ID: 4168288129-2761157908
                                                                                                                                                                                                                                                          • Opcode ID: 5ad5710af6eb9a49fb3a663163ef45b89f564519a07d2d471fc2d3d8a847424c
                                                                                                                                                                                                                                                          • Instruction ID: dd07eac9cc29fe384ff71e5e82d5f9ef3ac4186a277e1ec94c69e326a8e981b7
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5ad5710af6eb9a49fb3a663163ef45b89f564519a07d2d471fc2d3d8a847424c
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1AC20971E046288BDB65CE28DD407EAB7B6EB48315F1841EAD84EE7340E775AEC58F40
                                                                                                                                                                                                                                                          Function 005DE0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • recv.WS2_32(?,?,00000004,00000000), ref: 005DE10B
                                                                                                                                                                                                                                                          • recv.WS2_32(?,?,00000008,00000000), ref: 005DE140
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: recv
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 1507349165-0
                                                                                                                                                                                                                                                          • Opcode ID: 38643ed779b92449b4b36015690cbdffe2a2da04d115e595d652aadfca12aa63
                                                                                                                                                                                                                                                          • Instruction ID: 2a8a3a46bc6d75d4d28eb1f57c54e7934ceb6135241f6052a4101d6ff0f7872d
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 38643ed779b92449b4b36015690cbdffe2a2da04d115e595d652aadfca12aa63
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8131E471A002489FD720DBACCC86BEB7BB9FB09734F104626F511E7392C674A845CBA0
                                                                                                                                                                                                                                                          Function 00612D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                          • Opcode ID: ab61bf10f4e0d350edbf49199b42a5501ba1e5a8510d82623b8fc959c7faf839
                                                                                                                                                                                                                                                          • Instruction ID: 672725d7cc1a565dd8648ceccfdaa4a757d0f7a4f47d3fd74c51952708a9c355
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ab61bf10f4e0d350edbf49199b42a5501ba1e5a8510d82623b8fc959c7faf839
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 23F11D71E002299FDF14CFA8C8906EDBBF2FF48314F198269D915AB344D731AE418B94
                                                                                                                                                                                                                                                          Function 005ECBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • GetSystemTimePreciseAsFileTime.KERNEL32(?,005ECF52,?,00000003,00000003,?,005ECF87,?,?,?,00000003,00000003,?,005EC4FD,005D2FB9,00000001), ref: 005ECC03
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: Time$FilePreciseSystem
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 1802150274-0
                                                                                                                                                                                                                                                          • Opcode ID: bf539b9383089b65b188e8db4e4fd6b7e3c4ae90da1395f1a42461d21df5f853
                                                                                                                                                                                                                                                          • Instruction ID: a43cc553c8b729853d9ea580e6f8fdbcb22a3a56139bf45b9f2b27ec264a48e3
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bf539b9383089b65b188e8db4e4fd6b7e3c4ae90da1395f1a42461d21df5f853
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CFD02232A02438938B192F86EC089ECBFA9AF00B543001113E90D23120CA11ED429FD1
                                                                                                                                                                                                                                                          Function 00607F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: 0
                                                                                                                                                                                                                                                          • API String ID: 0-4108050209
                                                                                                                                                                                                                                                          • Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
                                                                                                                                                                                                                                                          • Instruction ID: 464242787e2e121a6c0145937d71f74d4cb778734b5dc0e451e621b91bca75d7
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8E514670AC860A5EDB7CCA2888957FF679BAF12340F14051DE4C3D73C2CE52BD4A8256
                                                                                                                                                                                                                                                          Function 005D4DE0 Relevance: .7, Instructions: 701COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                          • Opcode ID: 1a9c3bbc1a24f8ba7584ca79f133a18fbee5cafe88e77e614230ea2513ffaf99
                                                                                                                                                                                                                                                          • Instruction ID: 6b1cadae28fb2b8e65122c78d9c9a00bb87da28d31591232c031d8b6b6e55202
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1a9c3bbc1a24f8ba7584ca79f133a18fbee5cafe88e77e614230ea2513ffaf99
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1D2261B3F515144BDB4CCB5DDCA27ECB2E3AFD8214B0E903DA40AE3345EA79D9158684
                                                                                                                                                                                                                                                          Function 00617049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                          • Opcode ID: c17dc484df583d627e5b1c18892f5af6b1bd7de4cf33a20c57cd8ebbe0879ecf
                                                                                                                                                                                                                                                          • Instruction ID: 2b982eae6d528e6064072ec08beeec773166479b5b12de8c4356f74a5cb8bd1c
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c17dc484df583d627e5b1c18892f5af6b1bd7de4cf33a20c57cd8ebbe0879ecf
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 44B12B316146099FD715CF28C486BD57BB2FF45365F298658E89ACF3A1C335EA82CB40
                                                                                                                                                                                                                                                          Function 005D4B30 Relevance: .2, Instructions: 230COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                          • Opcode ID: 285347ec83ba97e137d94ecdea2fd81fd410873a85f484525a8ae93ec85915e1
                                                                                                                                                                                                                                                          • Instruction ID: e98cfa661ff12d144f1bb3f7061ab7317b7447ef2b8b32b40600355dc3be43c4
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 285347ec83ba97e137d94ecdea2fd81fd410873a85f484525a8ae93ec85915e1
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4D81EE74A002468FEB25CF6DD8907EEBFF2BB59300F1842ABD854A7352C3359945CBA0
                                                                                                                                                                                                                                                          Function 006178BB Relevance: .1, Instructions: 104COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                          • Opcode ID: d785a6a6c4ac6ebc62f40715d520a17552308983c08af2f643ad226c821c6cdc
                                                                                                                                                                                                                                                          • Instruction ID: f905f38bcf16c65a3fdfd04a1348ae73c62b96b6b3464bde2c2de5abf8d42396
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d785a6a6c4ac6ebc62f40715d520a17552308983c08af2f643ad226c821c6cdc
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5C21B673F2043947770CC47E8C522BDB6E1C78C541745823AE8A6EA2C1D968D917E2E4
                                                                                                                                                                                                                                                          Function 0061779B Relevance: .1, Instructions: 81COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                          • Opcode ID: 6d8a5a60817ef54c48fc07a53e81d955e1344d2b82ab01616595563cdb38dee8
                                                                                                                                                                                                                                                          • Instruction ID: 9f105b6f9dca565a91bd29e1d34916e0ccfd87fac037d524b4ddde6cf725e0ba
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6d8a5a60817ef54c48fc07a53e81d955e1344d2b82ab01616595563cdb38dee8
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B5118623F30C295B675C816D8C172BAA5D3EBD825071F533AD827E72C4E9A4DE23D290
                                                                                                                                                                                                                                                          Function 00618860 Relevance: .1, Instructions: 76COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                          • Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                                                                                                                                                                                                                                                          • Instruction ID: 720384bee34320b6d1aabea4d9e464568bbcdf5ed6730990c9ffddd017abc2b0
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 79113D776001824FE6948A3DC8F45F7E797EBD53217AC837AD0428B798DE22D9C59600
                                                                                                                                                                                                                                                          Function 0060A302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                          • Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
                                                                                                                                                                                                                                                          • Instruction ID: be8f11e810c595f6f4eed4a3bf9ad3e374d6b2ff66eabf2c394dc153c01effc0
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 34E08C32961228EBCB18DFD8C90499AF3EDEB49B40B65449AF501D3290C270DF00CBD4
                                                                                                                                                                                                                                                          Function 005D2EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 57040152-0
                                                                                                                                                                                                                                                          • Opcode ID: fcc8097f6e3fa913adff4d0fa268abcefc77cd3f0bb5fb19db52ce6ed092cda9
                                                                                                                                                                                                                                                          • Instruction ID: 473eb2bcf4d34b0132be031fdd2eea5b8997f1f594b70144d145867a457685b2
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: fcc8097f6e3fa913adff4d0fa268abcefc77cd3f0bb5fb19db52ce6ed092cda9
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1BA1EFB0A01246AFDB24DBA9C84975ABFB8FF54310F04852BE815D7341EB31EA05CBD2
                                                                                                                                                                                                                                                          Function 0060CBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: _strrchr
                                                                                                                                                                                                                                                          • String ID: v`
                                                                                                                                                                                                                                                          • API String ID: 3213747228-3504745396
                                                                                                                                                                                                                                                          • Opcode ID: 50646cb43b7217affa873159b33a8ceb5ad87b323bf0650c56aca3f8e12e7eb4
                                                                                                                                                                                                                                                          • Instruction ID: 43367b25cf0b97c74e912dd53663de7af667b044cb349135073100ba1118a91d
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 50646cb43b7217affa873159b33a8ceb5ad87b323bf0650c56aca3f8e12e7eb4
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B4B126329446459FDB19CF28C881BEFBBE6EF55360F14426AE845EB3C1D6348D42CBA4
                                                                                                                                                                                                                                                          Function 005EBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: Xtime_diff_to_millis2_xtime_get
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 531285432-0
                                                                                                                                                                                                                                                          • Opcode ID: 372cdf7059eb050306d6391f05a62415d1fd6c7385dcb64d57dabe32765cdd2e
                                                                                                                                                                                                                                                          • Instruction ID: 4c6bafdc727a0d05aa444c7e10a76b475e3ab7cd52de305c9a0d73ce78f058ca
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 372cdf7059eb050306d6391f05a62415d1fd6c7385dcb64d57dabe32765cdd2e
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B2213D71A0015AAFDF04EFA5D8869BFBFB9FF48710F100415F955A7261DB309D029BA0
                                                                                                                                                                                                                                                          Function 0060F35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000001.00000002.1442088031.00000000005D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005D0000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442070429.00000000005D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442088031.0000000000632000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442139974.0000000000639000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442157145.000000000063B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442175903.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442191336.0000000000646000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442207743.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442298240.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442316678.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442336336.00000000007C7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442370328.00000000007CE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442386390.00000000007CF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442402331.00000000007DA000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442417471.00000000007DF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442437368.00000000007F6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442452360.00000000007F8000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442467261.0000000000800000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442482522.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442502374.000000000081E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442518402.0000000000821000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442533724.0000000000822000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442549569.000000000082C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442565385.000000000082D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442588424.0000000000832000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442606670.0000000000844000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442621646.0000000000845000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442637235.0000000000846000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442652953.000000000084B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442668576.0000000000854000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442686952.000000000085C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442703222.0000000000864000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442718586.0000000000866000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442739240.0000000000875000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442755793.0000000000877000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442814733.0000000000884000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.0000000000886000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442834711.00000000008AA000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442882150.00000000008D6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442899922.00000000008D7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442916401.00000000008D8000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442934152.00000000008DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442951311.00000000008DD000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442971434.00000000008EC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000001.00000002.1442991735.00000000008EE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_1_2_5d0000_file.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: ___free_lconv_mon
                                                                                                                                                                                                                                                          • String ID: 8"c$`'c
                                                                                                                                                                                                                                                          • API String ID: 3903695350-4226804773
                                                                                                                                                                                                                                                          • Opcode ID: a125641936e87dff71987df6ffac7b8d23d215a4ba72bd4af251e357b686732a
                                                                                                                                                                                                                                                          • Instruction ID: 40515b48f6677adba664900d6c764ead992873cebc9a4e873a3c6f98d02caf5c
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a125641936e87dff71987df6ffac7b8d23d215a4ba72bd4af251e357b686732a
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 70315B31680301DFEB79AB79E845B9B73EAEF00351F10442DE449D6AD6DE74AC80CB55

                                                                                                                                                                                                                                                          Execution Graph

                                                                                                                                                                                                                                                          Execution Coverage:0.9%
                                                                                                                                                                                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                                          Signature Coverage:0%
                                                                                                                                                                                                                                                          Total number of Nodes:577
                                                                                                                                                                                                                                                          Total number of Limit Nodes:4
                                                                                                                                                                                                                                                          execution_graph 9645 686629 9648 6864c7 9645->9648 9650 6864d5 __cftof 9648->9650 9649 686520 9650->9649 9653 68652b 9650->9653 9652 68652a 9659 68a302 GetPEB 9653->9659 9655 686535 9656 68653a GetPEB 9655->9656 9657 68654a __cftof 9655->9657 9656->9657 9658 686562 ExitProcess 9657->9658 9660 68a31c __cftof 9659->9660 9660->9655 10181 6520a0 10182 66c68b __Mtx_init_in_situ 2 API calls 10181->10182 10183 6520ac 10182->10183 10275 654120 10276 65416a 10275->10276 10278 6541b2 std::invalid_argument::invalid_argument 10276->10278 10279 653ee0 10276->10279 10280 653f1e 10279->10280 10281 653f48 10279->10281 10280->10278 10282 653f58 10281->10282 10285 652c00 10281->10285 10282->10278 10286 652c0e 10285->10286 10292 66b847 10286->10292 10288 652c42 10289 652c49 10288->10289 10298 652c80 10288->10298 10289->10278 10291 652c58 Concurrency::cancel_current_task 10293 66b854 10292->10293 10297 66b873 Concurrency::details::_Reschedule_chore 10292->10297 10301 66cb77 10293->10301 10295 66b864 10295->10297 10303 66b81e 10295->10303 10297->10288 10309 66b7fb 10298->10309 10300 652cb2 shared_ptr 10300->10291 10302 66cb92 CreateThreadpoolWork 10301->10302 10302->10295 10304 66b827 Concurrency::details::_Reschedule_chore 10303->10304 10307 66cdcc 10304->10307 10306 66b841 10306->10297 10308 66cde1 TpPostWork 10307->10308 10308->10306 10310 66b807 10309->10310 10311 66b817 10309->10311 10310->10311 10313 66ca78 10310->10313 10311->10300 10314 66ca8d TpReleaseWork 10313->10314 10314->10311 10357 653fe0 10358 654022 10357->10358 10359 6540d2 10358->10359 10360 65408c 10358->10360 10363 654035 std::invalid_argument::invalid_argument 10358->10363 10361 653ee0 3 API calls 10359->10361 10364 6535e0 10360->10364 10361->10363 10365 653616 10364->10365 10369 65364e Concurrency::cancel_current_task shared_ptr std::invalid_argument::invalid_argument 10365->10369 10370 652ce0 10365->10370 10367 65369e 10368 652c00 3 API calls 10367->10368 10367->10369 10368->10369 10369->10363 10371 652d1d 10370->10371 10372 66bedf InitOnceExecuteOnce 10371->10372 10373 652d46 10372->10373 10374 652d88 10373->10374 10375 652d51 std::invalid_argument::invalid_argument 10373->10375 10379 66bef7 10373->10379 10377 652440 3 API calls 10374->10377 10375->10367 10378 652d9b 10377->10378 10378->10367 10380 66bf03 Concurrency::cancel_current_task 10379->10380 10381 66bf73 10380->10381 10382 66bf6a 10380->10382 10384 652ae0 4 API calls 10381->10384 10386 66be7f 10382->10386 10385 66bf6f 10384->10385 10385->10374 10387 66cc31 InitOnceExecuteOnce 10386->10387 10388 66be97 10387->10388 10389 66be9e 10388->10389 10390 686cbb 3 API calls 10388->10390 10389->10385 10391 66bea7 10390->10391 10391->10385 10184 655cad 10186 655caf __cftof 10184->10186 10185 655d17 shared_ptr std::invalid_argument::invalid_argument 10186->10185 10187 655c10 3 API calls 10186->10187 10188 6566ac 10187->10188 10189 655c10 3 API calls 10188->10189 10190 6566b1 10189->10190 10191 6522c0 3 API calls 10190->10191 10192 6566c9 shared_ptr 10191->10192 10193 655c10 3 API calls 10192->10193 10194 65673d 10193->10194 10195 6522c0 3 API calls 10194->10195 10197 656757 shared_ptr 10195->10197 10196 655c10 3 API calls 10196->10197 10197->10196 10198 6522c0 3 API calls 10197->10198 10199 656852 shared_ptr std::invalid_argument::invalid_argument 10197->10199 10198->10197 9666 659a77 9667 659a80 shared_ptr 9666->9667 9668 65a953 Sleep CreateMutexA 9667->9668 9669 659b4b shared_ptr 9667->9669 9670 65a98e 9668->9670 9671 654276 9674 652410 9671->9674 9673 65427f 9675 652424 9674->9675 9678 66b52d 9675->9678 9686 683aed 9678->9686 9680 65242a 9680->9673 9681 66b5a5 ___std_exception_copy 9693 66b1ad 9681->9693 9683 66b598 9689 66af56 9683->9689 9697 684f29 9686->9697 9690 66af9f ___std_exception_copy 9689->9690 9692 66afb2 shared_ptr 9690->9692 9735 66b39f 9690->9735 9692->9680 9694 66b1d8 9693->9694 9696 66b1e1 shared_ptr 9693->9696 9695 66b39f 4 API calls 9694->9695 9695->9696 9696->9680 9699 684f2e __cftof 9697->9699 9698 66b555 9698->9680 9698->9681 9698->9683 9699->9698 9703 688bfc __cftof 9699->9703 9704 68d634 9699->9704 9718 6865ed 9703->9718 9705 68d640 __cftof __dosmaperr 9704->9705 9706 68d81b __cftof 9705->9706 9707 68d726 9705->9707 9709 68d751 __cftof 9705->9709 9717 68d69c __dosmaperr ___std_exception_copy 9705->9717 9708 6865ed __cftof 3 API calls 9706->9708 9707->9709 9721 68d62b 9707->9721 9710 68d82e 9708->9710 9715 68d7a5 9709->9715 9709->9717 9724 68a671 9709->9724 9714 68d62b __cftof 3 API calls 9714->9709 9716 68a671 __cftof 3 API calls 9715->9716 9715->9717 9716->9717 9717->9703 9719 6864c7 __cftof 3 API calls 9718->9719 9720 6865fe 9719->9720 9722 68a671 __cftof 3 API calls 9721->9722 9723 68d630 9722->9723 9723->9714 9725 68a67b __dosmaperr __freea 9724->9725 9726 68a722 9725->9726 9729 688bec 9725->9729 9726->9715 9730 688bf1 __cftof 9729->9730 9731 68d634 __cftof 3 API calls 9730->9731 9734 688bfc __cftof 9730->9734 9731->9734 9732 6865ed __cftof 3 API calls 9733 688c2f 9732->9733 9734->9732 9746 66bedf 9735->9746 9738 66b3e8 9738->9692 9755 66cc31 9746->9755 9749 686cbb 9750 686cc7 __dosmaperr 9749->9750 9751 68a671 __cftof 3 API calls 9750->9751 9754 686ccc 9751->9754 9752 688bec __cftof 3 API calls 9753 686cf6 9752->9753 9754->9752 9756 66b3e1 9755->9756 9757 66cc3f InitOnceExecuteOnce 9755->9757 9756->9738 9756->9749 9757->9756 10200 6542b0 10203 653ac0 10200->10203 10202 6542bb shared_ptr 10204 653af9 10203->10204 10206 6532d0 5 API calls 10204->10206 10207 653b39 __Cnd_destroy_in_situ shared_ptr __Mtx_destroy_in_situ 10204->10207 10208 653c38 10204->10208 10205 6532d0 5 API calls 10210 653c5f 10205->10210 10206->10208 10207->10202 10208->10205 10208->10210 10209 653c68 10209->10202 10210->10209 10211 653810 3 API calls 10210->10211 10212 653cdb shared_ptr 10211->10212 10212->10202 10242 652170 10245 66c6fc 10242->10245 10244 65217a 10247 66c70c 10245->10247 10248 66c724 10245->10248 10247->10248 10249 66cfbe 10247->10249 10248->10244 10250 66ccd5 __Mtx_init_in_situ InitializeCriticalSectionEx 10249->10250 10251 66cfd0 10250->10251 10251->10247 10252 653970 10253 66c68b __Mtx_init_in_situ 2 API calls 10252->10253 10254 6539a7 10253->10254 10255 66c68b __Mtx_init_in_situ 2 API calls 10254->10255 10256 6539e6 10255->10256 10334 658b30 10335 658b7c 10334->10335 10336 655c10 3 API calls 10335->10336 10338 658b97 shared_ptr 10336->10338 10337 658d01 shared_ptr std::invalid_argument::invalid_argument 10338->10337 10339 655c10 3 API calls 10338->10339 10341 658d9a shared_ptr 10339->10341 10340 658e7e shared_ptr std::invalid_argument::invalid_argument 10341->10340 10342 655c10 3 API calls 10341->10342 10343 658f1a shared_ptr std::invalid_argument::invalid_argument 10342->10343 10392 6555f0 10393 655610 10392->10393 10394 6522c0 3 API calls 10393->10394 10395 655710 std::invalid_argument::invalid_argument 10393->10395 10394->10393 10396 6543f0 10397 66bedf InitOnceExecuteOnce 10396->10397 10398 65440a 10397->10398 10399 654411 10398->10399 10400 686cbb 3 API calls 10398->10400 10401 654424 10400->10401 10127 669ef0 10128 669f0c 10127->10128 10129 66c68b __Mtx_init_in_situ 2 API calls 10128->10129 10130 669f17 10129->10130 10412 688bbe 10413 688868 3 API calls 10412->10413 10414 688bdc 10413->10414 9764 65cc79 9766 65cc84 shared_ptr 9764->9766 9765 65ccda shared_ptr std::invalid_argument::invalid_argument 9766->9765 9770 655c10 9766->9770 9768 65ce9d 9788 65ca70 9768->9788 9771 655c54 9770->9771 9798 654b30 9771->9798 9773 655d17 shared_ptr std::invalid_argument::invalid_argument 9773->9768 9774 655c7b __cftof 9774->9773 9775 655c10 3 API calls 9774->9775 9776 6566ac 9775->9776 9777 655c10 3 API calls 9776->9777 9778 6566b1 9777->9778 9802 6522c0 9778->9802 9780 6566c9 shared_ptr 9781 655c10 3 API calls 9780->9781 9782 65673d 9781->9782 9783 6522c0 3 API calls 9782->9783 9785 656757 shared_ptr 9783->9785 9784 655c10 3 API calls 9784->9785 9785->9784 9786 6522c0 3 API calls 9785->9786 9787 656852 shared_ptr std::invalid_argument::invalid_argument 9785->9787 9786->9785 9787->9768 9790 65cadd 9788->9790 9789 65ccda shared_ptr std::invalid_argument::invalid_argument 9791 655c10 3 API calls 9790->9791 9796 65cc87 9790->9796 9792 65ccf9 9791->9792 10007 659030 9792->10007 9794 655c10 3 API calls 9795 65ce9d 9794->9795 9797 65ca70 3 API calls 9795->9797 9796->9789 9796->9794 9800 654ce5 9798->9800 9801 654b92 9798->9801 9800->9774 9801->9800 9805 686da6 9801->9805 9891 652280 9802->9891 9806 686dc2 9805->9806 9807 686db4 9805->9807 9806->9801 9810 686d19 9807->9810 9815 68690a 9810->9815 9814 686d3d 9814->9801 9816 68692a 9815->9816 9817 686921 9815->9817 9816->9817 9818 68a671 __cftof 3 API calls 9816->9818 9823 686d52 9817->9823 9819 68694a 9818->9819 9829 68b5fb 9819->9829 9824 686d8f 9823->9824 9826 686d5f 9823->9826 9883 68b67d 9824->9883 9828 686d6e 9826->9828 9878 68b6a1 9826->9878 9828->9814 9830 68b60e 9829->9830 9831 686960 9829->9831 9830->9831 9837 68f5ab 9830->9837 9833 68b628 9831->9833 9834 68b63b 9833->9834 9835 68b650 9833->9835 9834->9835 9844 68e6b1 9834->9844 9835->9817 9838 68f5b7 __dosmaperr 9837->9838 9839 68a671 __cftof 3 API calls 9838->9839 9841 68f5c0 __cftof __dosmaperr 9839->9841 9840 68f606 9840->9831 9841->9840 9842 688bec __cftof 3 API calls 9841->9842 9843 68f62b 9842->9843 9845 68a671 __cftof 3 API calls 9844->9845 9846 68e6bb 9845->9846 9849 68e5c9 9846->9849 9848 68e6c1 9848->9835 9850 68e5d5 __cftof __dosmaperr __freea 9849->9850 9851 68e5f6 9850->9851 9852 688bec __cftof 3 API calls 9850->9852 9851->9848 9854 68e668 9852->9854 9853 68e6a4 9853->9848 9854->9853 9858 68a72e 9854->9858 9860 68a739 __dosmaperr __freea 9858->9860 9859 688bec __cftof 3 API calls 9861 68a7c7 9859->9861 9860->9859 9862 68a7be 9860->9862 9863 68e4b0 9862->9863 9864 68e5c9 __cftof 3 API calls 9863->9864 9865 68e4c3 9864->9865 9870 68e259 9865->9870 9867 68e4cb __cftof 9869 68e4dc __cftof __dosmaperr __freea 9867->9869 9873 68e6c4 9867->9873 9869->9853 9871 68690a __cftof GetPEB ExitProcess GetPEB 9870->9871 9872 68e26b 9871->9872 9872->9867 9874 68e259 __cftof GetPEB ExitProcess GetPEB 9873->9874 9877 68e6e4 __cftof 9874->9877 9875 68e75a __cftof std::invalid_argument::invalid_argument 9875->9869 9876 68e32f __cftof GetPEB ExitProcess GetPEB 9876->9875 9877->9875 9877->9876 9879 68690a __cftof 3 API calls 9878->9879 9880 68b6be 9879->9880 9882 68b6ce std::invalid_argument::invalid_argument 9880->9882 9888 68f1bf 9880->9888 9882->9828 9884 68a671 __cftof 3 API calls 9883->9884 9885 68b688 9884->9885 9886 68b5fb __cftof 3 API calls 9885->9886 9887 68b698 9886->9887 9887->9828 9889 68690a __cftof 3 API calls 9888->9889 9890 68f1df __cftof __freea std::invalid_argument::invalid_argument 9889->9890 9890->9882 9892 652296 9891->9892 9895 6887f8 9892->9895 9898 687609 9895->9898 9897 6522a4 9897->9780 9899 687649 9898->9899 9903 687631 __dosmaperr ___std_exception_copy std::invalid_argument::invalid_argument 9898->9903 9900 68690a __cftof 3 API calls 9899->9900 9899->9903 9901 687661 9900->9901 9904 687bc4 9901->9904 9903->9897 9905 687bd5 9904->9905 9906 687be4 __dosmaperr ___std_exception_copy 9905->9906 9911 688168 9905->9911 9916 687dc2 9905->9916 9921 687de8 9905->9921 9931 687f36 9905->9931 9906->9903 9912 688171 9911->9912 9913 688178 9911->9913 9940 687b50 9912->9940 9913->9905 9915 688177 9915->9905 9917 687dcb 9916->9917 9918 687dd2 9916->9918 9919 687b50 3 API calls 9917->9919 9918->9905 9920 687dd1 9919->9920 9920->9905 9922 687e09 __dosmaperr ___std_exception_copy 9921->9922 9924 687def 9921->9924 9922->9905 9923 687f69 9929 687f77 9923->9929 9930 687f8b 9923->9930 9958 688241 9923->9958 9924->9922 9924->9923 9926 687fa2 9924->9926 9924->9929 9926->9930 9954 688390 9926->9954 9929->9930 9962 6886ea 9929->9962 9930->9905 9932 687f69 9931->9932 9933 687f4f 9931->9933 9935 688241 3 API calls 9932->9935 9938 687f77 9932->9938 9939 687f8b 9932->9939 9933->9932 9934 687fa2 9933->9934 9933->9938 9936 688390 3 API calls 9934->9936 9934->9939 9935->9938 9936->9938 9937 6886ea 3 API calls 9937->9939 9938->9937 9938->9939 9939->9905 9941 687b62 __dosmaperr 9940->9941 9944 688ab6 9941->9944 9943 687b85 __dosmaperr 9943->9915 9945 688ad1 9944->9945 9948 688868 9945->9948 9947 688adb 9947->9943 9949 68887a 9948->9949 9950 68690a __cftof GetPEB ExitProcess GetPEB 9949->9950 9953 68888f __dosmaperr ___std_exception_copy 9949->9953 9952 6888bf 9950->9952 9951 686d52 GetPEB ExitProcess GetPEB 9951->9952 9952->9951 9952->9953 9953->9947 9956 6883ab 9954->9956 9955 6883dd 9955->9929 9956->9955 9966 68c88e 9956->9966 9959 68825a 9958->9959 9973 68d3c8 9959->9973 9961 68830d 9961->9929 9961->9961 9963 68875d std::invalid_argument::invalid_argument 9962->9963 9965 688707 9962->9965 9963->9930 9964 68c88e __cftof 3 API calls 9964->9965 9965->9963 9965->9964 9969 68c733 9966->9969 9968 68c8a6 9968->9955 9970 68c743 9969->9970 9971 68690a __cftof GetPEB ExitProcess GetPEB 9970->9971 9972 68c748 __cftof __dosmaperr ___std_exception_copy 9970->9972 9971->9972 9972->9968 9974 68d3ee 9973->9974 9975 68d3d8 __dosmaperr ___std_exception_copy 9973->9975 9974->9975 9976 68d485 9974->9976 9977 68d48a 9974->9977 9975->9961 9979 68d4ae 9976->9979 9980 68d4e4 9976->9980 9986 68cbdf 9977->9986 9982 68d4cc 9979->9982 9983 68d4b3 9979->9983 10003 68cef8 9980->10003 9999 68d0e2 9982->9999 9992 68d23e 9983->9992 9987 68cbf1 9986->9987 9988 68690a __cftof GetPEB ExitProcess GetPEB 9987->9988 9989 68cc05 9988->9989 9990 68cef8 GetPEB ExitProcess GetPEB 9989->9990 9991 68cc0d __alldvrm __cftof __dosmaperr ___std_exception_copy _strrchr 9989->9991 9990->9991 9991->9975 9995 68d26c 9992->9995 9993 68d2a5 9993->9975 9994 68d2de 9997 68cf9a GetPEB ExitProcess GetPEB 9994->9997 9995->9993 9995->9994 9996 68d2b7 9995->9996 9998 68d16d GetPEB ExitProcess GetPEB 9996->9998 9997->9993 9998->9993 10000 68d10f 9999->10000 10001 68d14e 10000->10001 10002 68d16d GetPEB ExitProcess GetPEB 10000->10002 10001->9975 10002->10001 10004 68cf10 10003->10004 10005 68cf9a GetPEB ExitProcess GetPEB 10004->10005 10006 68cf75 10004->10006 10005->10006 10006->9975 10008 659080 10007->10008 10009 655c10 3 API calls 10008->10009 10010 65909a shared_ptr std::invalid_argument::invalid_argument 10009->10010 10010->9796 10131 66d0c7 10132 66d0d7 10131->10132 10133 66d17f 10132->10133 10134 66d17b RtlWakeAllConditionVariable 10132->10134 10011 653c47 10012 653c51 10011->10012 10015 653c5f 10012->10015 10018 6532d0 10012->10018 10013 653c68 10015->10013 10037 653810 10015->10037 10041 66c6ac 10018->10041 10020 65336b 10047 66c26a 10020->10047 10022 65333c __Mtx_unlock 10024 66c26a 4 API calls 10022->10024 10027 653350 std::invalid_argument::invalid_argument 10022->10027 10025 653377 10024->10025 10028 66c6ac GetSystemTimePreciseAsFileTime 10025->10028 10026 653314 10026->10020 10026->10022 10044 66bd4c 10026->10044 10027->10015 10029 6533af 10028->10029 10030 66c26a 4 API calls 10029->10030 10031 6533b6 __Cnd_broadcast 10029->10031 10030->10031 10032 66c26a 4 API calls 10031->10032 10033 6533d7 __Mtx_unlock 10031->10033 10032->10033 10034 66c26a 4 API calls 10033->10034 10035 6533eb 10033->10035 10036 65340e 10034->10036 10035->10015 10036->10015 10038 65381c 10037->10038 10084 652440 10038->10084 10051 66c452 10041->10051 10043 66c6b9 10043->10026 10068 66bb72 10044->10068 10046 66bd5c 10046->10026 10048 66c274 10047->10048 10049 66c292 10047->10049 10048->10049 10074 66c297 10048->10074 10049->10049 10052 66c4a8 10051->10052 10054 66c47a std::invalid_argument::invalid_argument 10051->10054 10052->10054 10057 66cf6b 10052->10057 10054->10043 10055 66cf6b _xtime_get GetSystemTimePreciseAsFileTime 10056 66c4fd __Xtime_diff_to_millis2 10055->10056 10056->10054 10056->10055 10058 66cf7a 10057->10058 10060 66cf87 __aulldvrm 10057->10060 10058->10060 10061 66cf44 10058->10061 10060->10056 10064 66cbea 10061->10064 10065 66cbfb GetSystemTimePreciseAsFileTime 10064->10065 10067 66cc07 10064->10067 10065->10067 10067->10060 10069 66bb9c 10068->10069 10070 66cf6b _xtime_get GetSystemTimePreciseAsFileTime 10069->10070 10073 66bba4 __Xtime_diff_to_millis2 std::invalid_argument::invalid_argument 10069->10073 10071 66bbcf __Xtime_diff_to_millis2 10070->10071 10072 66cf6b _xtime_get GetSystemTimePreciseAsFileTime 10071->10072 10071->10073 10072->10073 10073->10046 10077 652ae0 10074->10077 10076 66c2ae Concurrency::cancel_current_task 10078 66bedf InitOnceExecuteOnce 10077->10078 10079 652af4 __dosmaperr 10078->10079 10079->10076 10080 68a671 __cftof 3 API calls 10079->10080 10083 686ccc 10080->10083 10081 688bec __cftof 3 API calls 10082 686cf6 10081->10082 10083->10081 10087 66b5d6 10084->10087 10086 652472 10088 66b5f1 Concurrency::cancel_current_task 10087->10088 10089 688bec __cftof 3 API calls 10088->10089 10091 66b658 __cftof std::invalid_argument::invalid_argument 10088->10091 10090 66b69f 10089->10090 10091->10086 10100 652e00 10101 652e28 10100->10101 10104 66c68b 10101->10104 10107 66c3d5 10104->10107 10106 652e33 10108 66c3e1 10107->10108 10109 66c3eb 10107->10109 10110 66c3be 10108->10110 10111 66c39e 10108->10111 10109->10106 10120 66cd0a 10110->10120 10111->10109 10116 66ccd5 10111->10116 10114 66c3d0 10114->10106 10117 66cce3 InitializeCriticalSectionEx 10116->10117 10118 66c3b7 10116->10118 10117->10118 10118->10106 10121 66cd1f RtlInitializeConditionVariable 10120->10121 10121->10114 10138 65e0c0 recv 10139 65e122 recv 10138->10139 10140 65e157 recv 10139->10140 10141 65e191 10140->10141 10142 65e2b3 std::invalid_argument::invalid_argument 10141->10142 10143 66c6ac GetSystemTimePreciseAsFileTime 10141->10143 10144 65e2ee 10143->10144 10145 66c26a 4 API calls 10144->10145 10146 65e358 10145->10146 10147 652ec0 10148 652f06 10147->10148 10151 652f6f 10147->10151 10149 66c6ac GetSystemTimePreciseAsFileTime 10148->10149 10150 652f12 10149->10150 10153 65301e 10150->10153 10157 652f1d __Mtx_unlock 10150->10157 10152 652fef 10151->10152 10158 66c6ac GetSystemTimePreciseAsFileTime 10151->10158 10154 66c26a 4 API calls 10153->10154 10155 653024 10154->10155 10156 66c26a 4 API calls 10155->10156 10159 652fb9 10156->10159 10157->10151 10157->10155 10158->10159 10160 66c26a 4 API calls 10159->10160 10161 652fc0 __Mtx_unlock 10159->10161 10160->10161 10162 66c26a 4 API calls 10161->10162 10163 652fd8 __Cnd_broadcast 10161->10163 10162->10163 10163->10152 10164 66c26a 4 API calls 10163->10164 10165 65303c 10164->10165 10166 66c6ac GetSystemTimePreciseAsFileTime 10165->10166 10176 653080 shared_ptr __Mtx_unlock 10166->10176 10167 6531c5 10168 66c26a 4 API calls 10167->10168 10169 6531cb 10168->10169 10170 66c26a 4 API calls 10169->10170 10171 6531d1 10170->10171 10172 66c26a 4 API calls 10171->10172 10178 653193 __Mtx_unlock 10172->10178 10173 6531a7 std::invalid_argument::invalid_argument 10174 66c26a 4 API calls 10175 6531dd 10174->10175 10176->10167 10176->10169 10176->10173 10177 66c6ac GetSystemTimePreciseAsFileTime 10176->10177 10179 65315f 10177->10179 10178->10173 10178->10174 10179->10167 10179->10171 10179->10178 10180 66bd4c GetSystemTimePreciseAsFileTime 10179->10180 10180->10179 10415 658980 10417 6589d8 shared_ptr 10415->10417 10418 658aea 10415->10418 10416 655c10 3 API calls 10416->10417 10417->10416 10417->10418 10218 653c8e 10219 653c98 10218->10219 10220 652410 4 API calls 10219->10220 10221 653ca5 10219->10221 10220->10221 10222 653810 3 API calls 10221->10222 10223 653ccf 10222->10223 10224 653810 3 API calls 10223->10224 10225 653cdb shared_ptr 10224->10225 10092 686a44 10093 686a5c 10092->10093 10094 686a52 10092->10094 10097 68698d 10093->10097 10096 686a76 __freea 10098 68690a __cftof 3 API calls 10097->10098 10099 68699f 10098->10099 10099->10096 9661 65a856 9662 65a892 shared_ptr 9661->9662 9664 65a870 9661->9664 9663 65a953 Sleep CreateMutexA 9665 65a98e 9663->9665 9664->9662 9664->9663 10344 652b10 10345 652b1c 10344->10345 10346 652b1a 10344->10346 10347 66c26a 4 API calls 10345->10347 10348 652b22 10347->10348 10419 652b90 10420 652bce 10419->10420 10421 66b7fb TpReleaseWork 10420->10421 10422 652bdb shared_ptr std::invalid_argument::invalid_argument 10421->10422 10349 66d111 10351 66d122 10349->10351 10350 66d12a 10351->10350 10353 66d199 10351->10353 10354 66d1a7 SleepConditionVariableCS 10353->10354 10356 66d1c0 10353->10356 10354->10356 10356->10351 10423 653f9f 10424 653fad 10423->10424 10426 653fb6 10423->10426 10425 652410 4 API calls 10424->10425 10425->10426 10272 65215a 10273 66c6fc InitializeCriticalSectionEx 10272->10273 10274 652164 10273->10274

                                                                                                                                                                                                                                                          Executed Functions

                                                                                                                                                                                                                                                          Function 0068652B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 342 68652b-686538 call 68a302 345 68655a-68656c call 68656d ExitProcess 342->345 346 68653a-686548 GetPEB 342->346 346->345 347 68654a-686559 346->347 347->345
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • ExitProcess.KERNEL32(?,?,0068652A,?,?,?,?,?,00687661), ref: 00686567
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000002.00000002.1479494441.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Offset: 00650000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479469368.0000000000650000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479494441.00000000006B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479694722.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479717139.00000000006BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479735681.00000000006C5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479752843.00000000006C6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479768206.00000000006C7000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479859545.0000000000825000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479878392.0000000000827000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479897179.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479897179.0000000000847000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479944316.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479967918.000000000084F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479986703.000000000085A000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480002359.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480029584.0000000000876000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480047160.0000000000878000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480065912.0000000000880000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480087108.000000000088A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480118636.000000000089E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480144867.00000000008A1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480165756.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480265384.00000000008AC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480297194.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480388152.00000000008B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480423857.00000000008C4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480719079.00000000008C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480757059.00000000008C6000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480991867.00000000008CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481107297.00000000008D4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481151864.00000000008DC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481196485.00000000008E4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481308763.00000000008E6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1482357804.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1482914785.00000000008F7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1484857541.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486198292.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486198292.000000000092A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486710054.0000000000956000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486809740.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486842332.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486934401.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487022678.000000000095D000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487096641.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487209012.000000000096E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_650000_skotes.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: ExitProcess
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 621844428-0
                                                                                                                                                                                                                                                          • Opcode ID: eb5eedd13865fde05e62e64e621c97ff81569d4b873c0e0d813117df529f919a
                                                                                                                                                                                                                                                          • Instruction ID: a92eb838784530662a07c6a56c2211a2ec41e31f1013e10de096216026cd154a
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: eb5eedd13865fde05e62e64e621c97ff81569d4b873c0e0d813117df529f919a
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7AE0C230105108AFCF267B98C82DE8C7B6BEF41785F100A08FD1887222CB35ED81CB92
                                                                                                                                                                                                                                                          Function 00659BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140sleepsynchronizationCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 0 659ba5-659bc5 4 659bc7-659bd3 0->4 5 659bf3-659c0f 0->5 6 659bd5-659be3 4->6 7 659be9-659bf0 call 66d663 4->7 8 659c11-659c1d 5->8 9 659c3d-659c5c 5->9 6->7 12 65a91c 6->12 7->5 14 659c33-659c3a call 66d663 8->14 15 659c1f-659c2d 8->15 10 659c5e-659c6a 9->10 11 659c8a-65a916 call 6680c0 9->11 17 659c80-659c87 call 66d663 10->17 18 659c6c-659c7a 10->18 20 65a953-65a994 Sleep CreateMutexA 12->20 21 65a91c call 686c6a 12->21 14->9 15->12 15->14 17->11 18->12 18->17 30 65a9a7-65a9a8 20->30 31 65a996-65a998 20->31 21->20 31->30 32 65a99a-65a9a5 31->32 32->30
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • Sleep.KERNELBASE(00000064), ref: 0065A963
                                                                                                                                                                                                                                                          • CreateMutexA.KERNELBASE(00000000,00000000,006B3254), ref: 0065A981
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000002.00000002.1479494441.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Offset: 00650000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479469368.0000000000650000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479494441.00000000006B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479694722.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479717139.00000000006BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479735681.00000000006C5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479752843.00000000006C6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479768206.00000000006C7000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479859545.0000000000825000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479878392.0000000000827000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479897179.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479897179.0000000000847000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479944316.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479967918.000000000084F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479986703.000000000085A000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480002359.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480029584.0000000000876000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480047160.0000000000878000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480065912.0000000000880000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480087108.000000000088A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480118636.000000000089E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480144867.00000000008A1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480165756.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480265384.00000000008AC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480297194.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480388152.00000000008B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480423857.00000000008C4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480719079.00000000008C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480757059.00000000008C6000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480991867.00000000008CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481107297.00000000008D4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481151864.00000000008DC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481196485.00000000008E4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481308763.00000000008E6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1482357804.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1482914785.00000000008F7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1484857541.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486198292.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486198292.000000000092A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486710054.0000000000956000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486809740.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486842332.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486934401.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487022678.000000000095D000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487096641.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487209012.000000000096E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_650000_skotes.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: CreateMutexSleep
                                                                                                                                                                                                                                                          • String ID: T2k
                                                                                                                                                                                                                                                          • API String ID: 1464230837-2749674463
                                                                                                                                                                                                                                                          • Opcode ID: 94a59175976ba0308eb4ce376a8bd2fbd32c69196f9666979e7f8d21f524549a
                                                                                                                                                                                                                                                          • Instruction ID: 55261bb7de6b3e8a40b4e9709c05b4fa73f02f0b07f690d5196594fe9325522b
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 94a59175976ba0308eb4ce376a8bd2fbd32c69196f9666979e7f8d21f524549a
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6E312A71B14200CBEF08AB78EC857ADB7A3EB81315F244358E814D73D5C77559888761
                                                                                                                                                                                                                                                          Function 00659A77 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138sleepsynchronizationCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 34 659a77-659a90 37 659a92-659a9e 34->37 38 659abe-659ada 34->38 41 659ab4-659abb call 66d663 37->41 42 659aa0-659aae 37->42 39 659adc-659ae8 38->39 40 659b08-659b27 38->40 44 659afe-659b05 call 66d663 39->44 45 659aea-659af8 39->45 46 659b55-65a916 call 6680c0 40->46 47 659b29-659b35 40->47 41->38 42->41 48 65a917 42->48 44->40 45->44 45->48 53 659b37-659b45 47->53 54 659b4b-659b52 call 66d663 47->54 50 65a953-65a994 Sleep CreateMutexA 48->50 51 65a917 call 686c6a 48->51 63 65a9a7-65a9a8 50->63 64 65a996-65a998 50->64 51->50 53->48 53->54 54->46 64->63 65 65a99a-65a9a5 64->65 65->63
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • Sleep.KERNELBASE(00000064), ref: 0065A963
                                                                                                                                                                                                                                                          • CreateMutexA.KERNELBASE(00000000,00000000,006B3254), ref: 0065A981
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000002.00000002.1479494441.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Offset: 00650000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479469368.0000000000650000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479494441.00000000006B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479694722.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479717139.00000000006BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479735681.00000000006C5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479752843.00000000006C6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479768206.00000000006C7000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479859545.0000000000825000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479878392.0000000000827000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479897179.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479897179.0000000000847000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479944316.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479967918.000000000084F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479986703.000000000085A000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480002359.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480029584.0000000000876000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480047160.0000000000878000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480065912.0000000000880000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480087108.000000000088A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480118636.000000000089E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480144867.00000000008A1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480165756.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480265384.00000000008AC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480297194.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480388152.00000000008B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480423857.00000000008C4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480719079.00000000008C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480757059.00000000008C6000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480991867.00000000008CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481107297.00000000008D4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481151864.00000000008DC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481196485.00000000008E4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481308763.00000000008E6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1482357804.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1482914785.00000000008F7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1484857541.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486198292.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486198292.000000000092A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486710054.0000000000956000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486809740.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486842332.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486934401.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487022678.000000000095D000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487096641.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487209012.000000000096E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_650000_skotes.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: CreateMutexSleep
                                                                                                                                                                                                                                                          • String ID: T2k
                                                                                                                                                                                                                                                          • API String ID: 1464230837-2749674463
                                                                                                                                                                                                                                                          • Opcode ID: 56e9a92bf881565ecb754eebdf61692b7d2e0c4a81deb6c041be4723c84f1566
                                                                                                                                                                                                                                                          • Instruction ID: 686989e8f6906bffd120761c2af19e4d9edf5a490736961e7f86074dad8a1c80
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 56e9a92bf881565ecb754eebdf61692b7d2e0c4a81deb6c041be4723c84f1566
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 51310631B14240CBEF189B78E8C97ADB7A3DB81311F244358E814DB3D5D7755A888762
                                                                                                                                                                                                                                                          Function 00659F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137sleepsynchronizationCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 67 659f44-659f64 71 659f66-659f72 67->71 72 659f92-659fae 67->72 73 659f74-659f82 71->73 74 659f88-659f8f call 66d663 71->74 75 659fb0-659fbc 72->75 76 659fdc-659ffb 72->76 73->74 77 65a92b 73->77 74->72 79 659fd2-659fd9 call 66d663 75->79 80 659fbe-659fcc 75->80 81 659ffd-65a009 76->81 82 65a029-65a916 call 6680c0 76->82 86 65a953-65a994 Sleep CreateMutexA 77->86 87 65a92b call 686c6a 77->87 79->76 80->77 80->79 83 65a01f-65a026 call 66d663 81->83 84 65a00b-65a019 81->84 83->82 84->77 84->83 97 65a9a7-65a9a8 86->97 98 65a996-65a998 86->98 87->86 98->97 99 65a99a-65a9a5 98->99 99->97
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • Sleep.KERNELBASE(00000064), ref: 0065A963
                                                                                                                                                                                                                                                          • CreateMutexA.KERNELBASE(00000000,00000000,006B3254), ref: 0065A981
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000002.00000002.1479494441.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Offset: 00650000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479469368.0000000000650000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479494441.00000000006B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479694722.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479717139.00000000006BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479735681.00000000006C5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479752843.00000000006C6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479768206.00000000006C7000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479859545.0000000000825000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479878392.0000000000827000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479897179.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479897179.0000000000847000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479944316.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479967918.000000000084F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479986703.000000000085A000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480002359.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480029584.0000000000876000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480047160.0000000000878000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480065912.0000000000880000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480087108.000000000088A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480118636.000000000089E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480144867.00000000008A1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480165756.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480265384.00000000008AC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480297194.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480388152.00000000008B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480423857.00000000008C4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480719079.00000000008C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480757059.00000000008C6000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480991867.00000000008CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481107297.00000000008D4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481151864.00000000008DC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481196485.00000000008E4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481308763.00000000008E6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1482357804.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1482914785.00000000008F7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1484857541.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486198292.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486198292.000000000092A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486710054.0000000000956000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486809740.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486842332.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486934401.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487022678.000000000095D000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487096641.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487209012.000000000096E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_650000_skotes.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: CreateMutexSleep
                                                                                                                                                                                                                                                          • String ID: T2k
                                                                                                                                                                                                                                                          • API String ID: 1464230837-2749674463
                                                                                                                                                                                                                                                          • Opcode ID: 00b344c6f6c07196140ddb5280be921352f4992623edb520ee02b8daf877ee85
                                                                                                                                                                                                                                                          • Instruction ID: 8cb8d1d73ad9e0bdb6d12c6019572ae7c17397b714f16c139a0b8ed5a09fcdf8
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 00b344c6f6c07196140ddb5280be921352f4992623edb520ee02b8daf877ee85
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5A312631B10200CBEF18ABB8DC857ADB7A3EF85315F248719E814DB3D5C73599888762
                                                                                                                                                                                                                                                          Function 0065A079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136sleepsynchronizationCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 101 65a079-65a099 105 65a0c7-65a0e3 101->105 106 65a09b-65a0a7 101->106 109 65a0e5-65a0f1 105->109 110 65a111-65a130 105->110 107 65a0bd-65a0c4 call 66d663 106->107 108 65a0a9-65a0b7 106->108 107->105 108->107 111 65a930-65a994 call 686c6a Sleep CreateMutexA 108->111 113 65a107-65a10e call 66d663 109->113 114 65a0f3-65a101 109->114 115 65a132-65a13e 110->115 116 65a15e-65a916 call 6680c0 110->116 131 65a9a7-65a9a8 111->131 132 65a996-65a998 111->132 113->110 114->111 114->113 117 65a154-65a15b call 66d663 115->117 118 65a140-65a14e 115->118 117->116 118->111 118->117 132->131 133 65a99a-65a9a5 132->133 133->131
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • Sleep.KERNELBASE(00000064), ref: 0065A963
                                                                                                                                                                                                                                                          • CreateMutexA.KERNELBASE(00000000,00000000,006B3254), ref: 0065A981
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000002.00000002.1479494441.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Offset: 00650000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479469368.0000000000650000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479494441.00000000006B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479694722.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479717139.00000000006BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479735681.00000000006C5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479752843.00000000006C6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479768206.00000000006C7000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479859545.0000000000825000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479878392.0000000000827000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479897179.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479897179.0000000000847000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479944316.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479967918.000000000084F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479986703.000000000085A000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480002359.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480029584.0000000000876000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480047160.0000000000878000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480065912.0000000000880000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480087108.000000000088A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480118636.000000000089E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480144867.00000000008A1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480165756.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480265384.00000000008AC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480297194.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480388152.00000000008B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480423857.00000000008C4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480719079.00000000008C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480757059.00000000008C6000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480991867.00000000008CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481107297.00000000008D4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481151864.00000000008DC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481196485.00000000008E4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481308763.00000000008E6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1482357804.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1482914785.00000000008F7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1484857541.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486198292.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486198292.000000000092A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486710054.0000000000956000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486809740.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486842332.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486934401.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487022678.000000000095D000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487096641.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487209012.000000000096E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_650000_skotes.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: CreateMutexSleep
                                                                                                                                                                                                                                                          • String ID: T2k
                                                                                                                                                                                                                                                          • API String ID: 1464230837-2749674463
                                                                                                                                                                                                                                                          • Opcode ID: 481ddbd37d1cfb632b3f88d6f0a627300867d3902e7537be6e78a6763f7135b6
                                                                                                                                                                                                                                                          • Instruction ID: c1f8059db0e8f838dd5fe24fce01af93c5ee5d0a17b70ec22de51a0abd4bf90f
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 481ddbd37d1cfb632b3f88d6f0a627300867d3902e7537be6e78a6763f7135b6
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F2314831B102009BEF189BB8DC89BADB7A3DB85315F244319E814DB3D5C73699888766
                                                                                                                                                                                                                                                          Function 0065A1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135sleepsynchronizationCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 135 65a1ae-65a1ce 139 65a1d0-65a1dc 135->139 140 65a1fc-65a218 135->140 141 65a1f2-65a1f9 call 66d663 139->141 142 65a1de-65a1ec 139->142 143 65a246-65a265 140->143 144 65a21a-65a226 140->144 141->140 142->141 145 65a935 142->145 149 65a267-65a273 143->149 150 65a293-65a916 call 6680c0 143->150 147 65a23c-65a243 call 66d663 144->147 148 65a228-65a236 144->148 152 65a953-65a994 Sleep CreateMutexA 145->152 153 65a935 call 686c6a 145->153 147->143 148->145 148->147 156 65a275-65a283 149->156 157 65a289-65a290 call 66d663 149->157 165 65a9a7-65a9a8 152->165 166 65a996-65a998 152->166 153->152 156->145 156->157 157->150 166->165 167 65a99a-65a9a5 166->167 167->165
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • Sleep.KERNELBASE(00000064), ref: 0065A963
                                                                                                                                                                                                                                                          • CreateMutexA.KERNELBASE(00000000,00000000,006B3254), ref: 0065A981
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000002.00000002.1479494441.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Offset: 00650000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479469368.0000000000650000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479494441.00000000006B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479694722.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479717139.00000000006BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479735681.00000000006C5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479752843.00000000006C6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479768206.00000000006C7000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479859545.0000000000825000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479878392.0000000000827000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479897179.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479897179.0000000000847000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479944316.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479967918.000000000084F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479986703.000000000085A000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480002359.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480029584.0000000000876000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480047160.0000000000878000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480065912.0000000000880000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480087108.000000000088A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480118636.000000000089E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480144867.00000000008A1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480165756.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480265384.00000000008AC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480297194.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480388152.00000000008B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480423857.00000000008C4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480719079.00000000008C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480757059.00000000008C6000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480991867.00000000008CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481107297.00000000008D4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481151864.00000000008DC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481196485.00000000008E4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481308763.00000000008E6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1482357804.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1482914785.00000000008F7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1484857541.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486198292.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486198292.000000000092A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486710054.0000000000956000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486809740.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486842332.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486934401.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487022678.000000000095D000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487096641.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487209012.000000000096E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_650000_skotes.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: CreateMutexSleep
                                                                                                                                                                                                                                                          • String ID: T2k
                                                                                                                                                                                                                                                          • API String ID: 1464230837-2749674463
                                                                                                                                                                                                                                                          • Opcode ID: 1fa9f301cc043c10b6f8de6beb2ea6cd46fd8ddbb655ab81cf71cc6d698dd7f7
                                                                                                                                                                                                                                                          • Instruction ID: 5fcad7c887295945eee365f073f49a26c85bd6bc69aff6cd4c636821f97a0ef6
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1fa9f301cc043c10b6f8de6beb2ea6cd46fd8ddbb655ab81cf71cc6d698dd7f7
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D1314A31B102409FEB189BB8DC897ADB763EF86311F24431DE814DB3D5C7355A888766
                                                                                                                                                                                                                                                          Function 0065A418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133sleepsynchronizationCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 169 65a418-65a438 173 65a466-65a482 169->173 174 65a43a-65a446 169->174 177 65a484-65a490 173->177 178 65a4b0-65a4cf 173->178 175 65a45c-65a463 call 66d663 174->175 176 65a448-65a456 174->176 175->173 176->175 181 65a93f-65a949 call 686c6a * 2 176->181 183 65a4a6-65a4ad call 66d663 177->183 184 65a492-65a4a0 177->184 179 65a4d1-65a4dd 178->179 180 65a4fd-65a916 call 6680c0 178->180 186 65a4f3-65a4fa call 66d663 179->186 187 65a4df-65a4ed 179->187 200 65a94e 181->200 201 65a949 call 686c6a 181->201 183->178 184->181 184->183 186->180 187->181 187->186 202 65a953-65a994 Sleep CreateMutexA 200->202 203 65a94e call 686c6a 200->203 201->200 205 65a9a7-65a9a8 202->205 206 65a996-65a998 202->206 203->202 206->205 207 65a99a-65a9a5 206->207 207->205
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • Sleep.KERNELBASE(00000064), ref: 0065A963
                                                                                                                                                                                                                                                          • CreateMutexA.KERNELBASE(00000000,00000000,006B3254), ref: 0065A981
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000002.00000002.1479494441.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Offset: 00650000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479469368.0000000000650000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479494441.00000000006B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479694722.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479717139.00000000006BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479735681.00000000006C5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479752843.00000000006C6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479768206.00000000006C7000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479859545.0000000000825000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479878392.0000000000827000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479897179.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479897179.0000000000847000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479944316.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479967918.000000000084F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479986703.000000000085A000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480002359.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480029584.0000000000876000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480047160.0000000000878000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480065912.0000000000880000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480087108.000000000088A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480118636.000000000089E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480144867.00000000008A1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480165756.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480265384.00000000008AC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480297194.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480388152.00000000008B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480423857.00000000008C4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480719079.00000000008C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480757059.00000000008C6000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480991867.00000000008CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481107297.00000000008D4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481151864.00000000008DC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481196485.00000000008E4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481308763.00000000008E6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1482357804.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1482914785.00000000008F7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1484857541.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486198292.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486198292.000000000092A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486710054.0000000000956000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486809740.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486842332.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486934401.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487022678.000000000095D000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487096641.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487209012.000000000096E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_650000_skotes.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: CreateMutexSleep
                                                                                                                                                                                                                                                          • String ID: T2k
                                                                                                                                                                                                                                                          • API String ID: 1464230837-2749674463
                                                                                                                                                                                                                                                          • Opcode ID: 058dd211adc2650a2f49018fd41f98c710239fe4490585c76f93ee9e6c1541a3
                                                                                                                                                                                                                                                          • Instruction ID: 34fdb7b511b27b57b07585520c890907f02ca682d6b74a1c004fcf7d4f56b4e2
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 058dd211adc2650a2f49018fd41f98c710239fe4490585c76f93ee9e6c1541a3
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5A312531B102009BEB08ABF8D889BADB7A3EF81315F24431DE854DB3D5D77599888766
                                                                                                                                                                                                                                                          Function 0065A54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132sleepsynchronizationCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 209 65a54d-65a56d 213 65a56f-65a57b 209->213 214 65a59b-65a5b7 209->214 215 65a591-65a598 call 66d663 213->215 216 65a57d-65a58b 213->216 217 65a5e5-65a604 214->217 218 65a5b9-65a5c5 214->218 215->214 216->215 221 65a944-65a949 call 686c6a 216->221 219 65a606-65a612 217->219 220 65a632-65a916 call 6680c0 217->220 223 65a5c7-65a5d5 218->223 224 65a5db-65a5e2 call 66d663 218->224 227 65a614-65a622 219->227 228 65a628-65a62f call 66d663 219->228 235 65a94e 221->235 236 65a949 call 686c6a 221->236 223->221 223->224 224->217 227->221 227->228 228->220 239 65a953-65a994 Sleep CreateMutexA 235->239 240 65a94e call 686c6a 235->240 236->235 243 65a9a7-65a9a8 239->243 244 65a996-65a998 239->244 240->239 244->243 245 65a99a-65a9a5 244->245 245->243
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • Sleep.KERNELBASE(00000064), ref: 0065A963
                                                                                                                                                                                                                                                          • CreateMutexA.KERNELBASE(00000000,00000000,006B3254), ref: 0065A981
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000002.00000002.1479494441.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Offset: 00650000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479469368.0000000000650000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479494441.00000000006B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479694722.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479717139.00000000006BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479735681.00000000006C5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479752843.00000000006C6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479768206.00000000006C7000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479859545.0000000000825000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479878392.0000000000827000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479897179.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479897179.0000000000847000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479944316.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479967918.000000000084F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479986703.000000000085A000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480002359.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480029584.0000000000876000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480047160.0000000000878000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480065912.0000000000880000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480087108.000000000088A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480118636.000000000089E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480144867.00000000008A1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480165756.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480265384.00000000008AC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480297194.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480388152.00000000008B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480423857.00000000008C4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480719079.00000000008C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480757059.00000000008C6000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480991867.00000000008CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481107297.00000000008D4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481151864.00000000008DC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481196485.00000000008E4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481308763.00000000008E6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1482357804.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1482914785.00000000008F7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1484857541.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486198292.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486198292.000000000092A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486710054.0000000000956000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486809740.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486842332.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486934401.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487022678.000000000095D000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487096641.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487209012.000000000096E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_650000_skotes.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: CreateMutexSleep
                                                                                                                                                                                                                                                          • String ID: T2k
                                                                                                                                                                                                                                                          • API String ID: 1464230837-2749674463
                                                                                                                                                                                                                                                          • Opcode ID: da8e637d3851ae7947b98c7bb673c884be339e272603b007efeb52a77fd5fe33
                                                                                                                                                                                                                                                          • Instruction ID: 9901dc3289011aecae3e305c6ac9ebdd534e97bcf9461989d24f89bbd3daf5a1
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: da8e637d3851ae7947b98c7bb673c884be339e272603b007efeb52a77fd5fe33
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 86310771B001008BEB08ABB8DC89BADB7A3EB85315F244758E854DB3D5D7359D888766
                                                                                                                                                                                                                                                          Function 0065A682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131sleepsynchronizationCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 247 65a682-65a6a2 251 65a6a4-65a6b0 247->251 252 65a6d0-65a6ec 247->252 255 65a6c6-65a6cd call 66d663 251->255 256 65a6b2-65a6c0 251->256 253 65a6ee-65a6fa 252->253 254 65a71a-65a739 252->254 258 65a710-65a717 call 66d663 253->258 259 65a6fc-65a70a 253->259 260 65a767-65a916 call 6680c0 254->260 261 65a73b-65a747 254->261 255->252 256->255 262 65a949 256->262 258->254 259->258 259->262 267 65a75d-65a764 call 66d663 261->267 268 65a749-65a757 261->268 264 65a94e 262->264 265 65a949 call 686c6a 262->265 271 65a953-65a994 Sleep CreateMutexA 264->271 272 65a94e call 686c6a 264->272 265->264 267->260 268->262 268->267 279 65a9a7-65a9a8 271->279 280 65a996-65a998 271->280 272->271 280->279 281 65a99a-65a9a5 280->281 281->279
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • Sleep.KERNELBASE(00000064), ref: 0065A963
                                                                                                                                                                                                                                                          • CreateMutexA.KERNELBASE(00000000,00000000,006B3254), ref: 0065A981
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000002.00000002.1479494441.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Offset: 00650000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479469368.0000000000650000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479494441.00000000006B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479694722.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479717139.00000000006BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479735681.00000000006C5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479752843.00000000006C6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479768206.00000000006C7000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479859545.0000000000825000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479878392.0000000000827000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479897179.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479897179.0000000000847000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479944316.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479967918.000000000084F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479986703.000000000085A000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480002359.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480029584.0000000000876000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480047160.0000000000878000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480065912.0000000000880000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480087108.000000000088A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480118636.000000000089E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480144867.00000000008A1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480165756.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480265384.00000000008AC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480297194.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480388152.00000000008B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480423857.00000000008C4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480719079.00000000008C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480757059.00000000008C6000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480991867.00000000008CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481107297.00000000008D4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481151864.00000000008DC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481196485.00000000008E4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481308763.00000000008E6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1482357804.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1482914785.00000000008F7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1484857541.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486198292.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486198292.000000000092A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486710054.0000000000956000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486809740.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486842332.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486934401.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487022678.000000000095D000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487096641.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487209012.000000000096E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_650000_skotes.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: CreateMutexSleep
                                                                                                                                                                                                                                                          • String ID: T2k
                                                                                                                                                                                                                                                          • API String ID: 1464230837-2749674463
                                                                                                                                                                                                                                                          • Opcode ID: 4557c52cebf9a549369b08e4aa34be2ec628f2617aa61861997dcef61969edc9
                                                                                                                                                                                                                                                          • Instruction ID: 5006ce977a1940920063e2799d0d411a3cd183e5506a3dffb78468abb47ba6c6
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4557c52cebf9a549369b08e4aa34be2ec628f2617aa61861997dcef61969edc9
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A8314871B002008BEF08DBB8DC89BADB7A3EB85311F248758E814DB3D5C73599888766
                                                                                                                                                                                                                                                          Function 0065A856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100sleepsynchronizationCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 306 65a856-65a86e 307 65a870-65a87c 306->307 308 65a89c-65a89e 306->308 311 65a892-65a899 call 66d663 307->311 312 65a87e-65a88c 307->312 309 65a8a0-65a8a7 308->309 310 65a8a9-65a8b1 call 657d30 308->310 313 65a8eb-65a916 call 6680c0 309->313 322 65a8e4-65a8e6 310->322 323 65a8b3-65a8bb call 657d30 310->323 311->308 312->311 315 65a94e 312->315 318 65a953-65a987 Sleep CreateMutexA 315->318 319 65a94e call 686c6a 315->319 326 65a98e-65a994 318->326 319->318 322->313 323->322 330 65a8bd-65a8c5 call 657d30 323->330 328 65a9a7-65a9a8 326->328 329 65a996-65a998 326->329 329->328 331 65a99a-65a9a5 329->331 330->322 335 65a8c7-65a8cf call 657d30 330->335 331->328 335->322 338 65a8d1-65a8d9 call 657d30 335->338 338->322 341 65a8db-65a8e2 338->341 341->313
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • Sleep.KERNELBASE(00000064), ref: 0065A963
                                                                                                                                                                                                                                                          • CreateMutexA.KERNELBASE(00000000,00000000,006B3254), ref: 0065A981
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000002.00000002.1479494441.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Offset: 00650000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479469368.0000000000650000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479494441.00000000006B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479694722.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479717139.00000000006BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479735681.00000000006C5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479752843.00000000006C6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479768206.00000000006C7000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479859545.0000000000825000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479878392.0000000000827000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479897179.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479897179.0000000000847000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479944316.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479967918.000000000084F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479986703.000000000085A000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480002359.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480029584.0000000000876000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480047160.0000000000878000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480065912.0000000000880000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480087108.000000000088A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480118636.000000000089E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480144867.00000000008A1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480165756.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480265384.00000000008AC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480297194.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480388152.00000000008B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480423857.00000000008C4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480719079.00000000008C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480757059.00000000008C6000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480991867.00000000008CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481107297.00000000008D4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481151864.00000000008DC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481196485.00000000008E4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481308763.00000000008E6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1482357804.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1482914785.00000000008F7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1484857541.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486198292.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486198292.000000000092A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486710054.0000000000956000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486809740.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486842332.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486934401.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487022678.000000000095D000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487096641.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487209012.000000000096E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_650000_skotes.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: CreateMutexSleep
                                                                                                                                                                                                                                                          • String ID: T2k
                                                                                                                                                                                                                                                          • API String ID: 1464230837-2749674463
                                                                                                                                                                                                                                                          • Opcode ID: 5875f753fc2e305e2bf8b1b7e988e92b0ebfad51fdf5cd72900409c7100f2202
                                                                                                                                                                                                                                                          • Instruction ID: 52b95324abe6a031b45edc79810969b347bfcfc53eb45593f76fca5759c26671
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5875f753fc2e305e2bf8b1b7e988e92b0ebfad51fdf5cd72900409c7100f2202
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AD213D717442019EEF2467E8A88677DB363DF81302F240B1AED04D73D1CA765D8982A7
                                                                                                                                                                                                                                                          Function 0065A34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100sleepsynchronizationCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 283 65a34f-65a35b 284 65a371-65a39a call 66d663 283->284 285 65a35d-65a36b 283->285 291 65a39c-65a3a8 284->291 292 65a3c8-65a916 call 6680c0 284->292 285->284 286 65a93a 285->286 289 65a953-65a994 Sleep CreateMutexA 286->289 290 65a93a call 686c6a 286->290 299 65a9a7-65a9a8 289->299 300 65a996-65a998 289->300 290->289 293 65a3be-65a3c5 call 66d663 291->293 294 65a3aa-65a3b8 291->294 293->292 294->286 294->293 300->299 303 65a99a-65a9a5 300->303 303->299
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • Sleep.KERNELBASE(00000064), ref: 0065A963
                                                                                                                                                                                                                                                          • CreateMutexA.KERNELBASE(00000000,00000000,006B3254), ref: 0065A981
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000002.00000002.1479494441.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Offset: 00650000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479469368.0000000000650000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479494441.00000000006B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479694722.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479717139.00000000006BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479735681.00000000006C5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479752843.00000000006C6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479768206.00000000006C7000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479859545.0000000000825000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479878392.0000000000827000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479897179.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479897179.0000000000847000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479944316.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479967918.000000000084F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479986703.000000000085A000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480002359.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480029584.0000000000876000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480047160.0000000000878000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480065912.0000000000880000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480087108.000000000088A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480118636.000000000089E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480144867.00000000008A1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480165756.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480265384.00000000008AC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480297194.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480388152.00000000008B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480423857.00000000008C4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480719079.00000000008C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480757059.00000000008C6000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480991867.00000000008CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481107297.00000000008D4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481151864.00000000008DC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481196485.00000000008E4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481308763.00000000008E6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1482357804.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1482914785.00000000008F7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1484857541.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486198292.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486198292.000000000092A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486710054.0000000000956000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486809740.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486842332.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486934401.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487022678.000000000095D000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487096641.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487209012.000000000096E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_650000_skotes.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: CreateMutexSleep
                                                                                                                                                                                                                                                          • String ID: T2k
                                                                                                                                                                                                                                                          • API String ID: 1464230837-2749674463
                                                                                                                                                                                                                                                          • Opcode ID: 919db5fcc50fdf7e3ce7aae8b30f17d429107abe849aca4587bb8f32118d2ba2
                                                                                                                                                                                                                                                          • Instruction ID: 563736d2456b79c446bd9c50d57bec2092ebc9b84ca9c4ed7f12a409714a1db0
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 919db5fcc50fdf7e3ce7aae8b30f17d429107abe849aca4587bb8f32118d2ba2
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AE2149717542009BEB18ABA8EC8576CB7A3DBD1316F24431DE808D77D4C7755A888362

                                                                                                                                                                                                                                                          Non-executed Functions

                                                                                                                                                                                                                                                          Function 0068CBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000002.00000002.1479494441.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Offset: 00650000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479469368.0000000000650000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479494441.00000000006B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479694722.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479717139.00000000006BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479735681.00000000006C5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479752843.00000000006C6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479768206.00000000006C7000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479859545.0000000000825000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479878392.0000000000827000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479897179.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479897179.0000000000847000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479944316.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479967918.000000000084F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479986703.000000000085A000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480002359.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480029584.0000000000876000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480047160.0000000000878000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480065912.0000000000880000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480087108.000000000088A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480118636.000000000089E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480144867.00000000008A1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480165756.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480265384.00000000008AC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480297194.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480388152.00000000008B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480423857.00000000008C4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480719079.00000000008C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480757059.00000000008C6000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480991867.00000000008CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481107297.00000000008D4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481151864.00000000008DC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481196485.00000000008E4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481308763.00000000008E6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1482357804.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1482914785.00000000008F7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1484857541.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486198292.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486198292.000000000092A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486710054.0000000000956000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486809740.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486842332.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486934401.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487022678.000000000095D000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487096641.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487209012.000000000096E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_650000_skotes.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: _strrchr
                                                                                                                                                                                                                                                          • String ID: vh
                                                                                                                                                                                                                                                          • API String ID: 3213747228-3728581510
                                                                                                                                                                                                                                                          • Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
                                                                                                                                                                                                                                                          • Instruction ID: fe6d98c549092f4fa220c858e2a3edded7231bde7c80a2afe9644c7fd7c9a67b
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CAB128329046459FDB15EF28C881BFEBBE6EF45360F1442A9E855EB342D6349D02CBB4
                                                                                                                                                                                                                                                          Function 00652EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000002.00000002.1479494441.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Offset: 00650000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479469368.0000000000650000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479494441.00000000006B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479694722.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479717139.00000000006BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479735681.00000000006C5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479752843.00000000006C6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479768206.00000000006C7000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479859545.0000000000825000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479878392.0000000000827000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479897179.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479897179.0000000000847000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479944316.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479967918.000000000084F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479986703.000000000085A000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480002359.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480029584.0000000000876000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480047160.0000000000878000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480065912.0000000000880000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480087108.000000000088A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480118636.000000000089E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480144867.00000000008A1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480165756.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480265384.00000000008AC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480297194.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480388152.00000000008B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480423857.00000000008C4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480719079.00000000008C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480757059.00000000008C6000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480991867.00000000008CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481107297.00000000008D4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481151864.00000000008DC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481196485.00000000008E4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481308763.00000000008E6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1482357804.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1482914785.00000000008F7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1484857541.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486198292.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486198292.000000000092A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486710054.0000000000956000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486809740.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486842332.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486934401.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487022678.000000000095D000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487096641.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487209012.000000000096E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_650000_skotes.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: Mtx_unlock$Cnd_broadcast
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 32384418-0
                                                                                                                                                                                                                                                          • Opcode ID: c6df6624782e090c889877462fcabf9a4526e2d1fa78db3e41b9e9fdf166975d
                                                                                                                                                                                                                                                          • Instruction ID: e1127944055078ddcb710b970a884eeb44b1d4b3ff30977a67cc94ab5c8d86ed
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c6df6624782e090c889877462fcabf9a4526e2d1fa78db3e41b9e9fdf166975d
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CCA1D170A01B259FDB20DF75C9447AAB7AAFF15761F044129EC15D7381EB31EA08CB91
                                                                                                                                                                                                                                                          Function 0066BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000002.00000002.1479494441.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Offset: 00650000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479469368.0000000000650000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479494441.00000000006B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479694722.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479717139.00000000006BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479735681.00000000006C5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479752843.00000000006C6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479768206.00000000006C7000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479859545.0000000000825000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479878392.0000000000827000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479897179.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479897179.0000000000847000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479944316.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479967918.000000000084F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479986703.000000000085A000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480002359.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480029584.0000000000876000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480047160.0000000000878000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480065912.0000000000880000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480087108.000000000088A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480118636.000000000089E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480144867.00000000008A1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480165756.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480265384.00000000008AC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480297194.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480388152.00000000008B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480423857.00000000008C4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480719079.00000000008C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480757059.00000000008C6000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480991867.00000000008CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481107297.00000000008D4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481151864.00000000008DC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481196485.00000000008E4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481308763.00000000008E6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1482357804.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1482914785.00000000008F7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1484857541.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486198292.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486198292.000000000092A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486710054.0000000000956000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486809740.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486842332.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486934401.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487022678.000000000095D000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487096641.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487209012.000000000096E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_650000_skotes.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: Xtime_diff_to_millis2_xtime_get
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 531285432-0
                                                                                                                                                                                                                                                          • Opcode ID: 9f61e8e6b0e53be6efeaaa9d483f8e2883c0261a9c11400f1744eaf37835e74b
                                                                                                                                                                                                                                                          • Instruction ID: 58d035d04f7a2f15712b2e4416efa682ea8a0afabf27dc0d5ae7064227268655
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9f61e8e6b0e53be6efeaaa9d483f8e2883c0261a9c11400f1744eaf37835e74b
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3A216271A00619AFDF40EFA4CC959BEB7BAEF08720F101019F501F7251DB30AE419BA4
                                                                                                                                                                                                                                                          Function 0068F35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000002.00000002.1479494441.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Offset: 00650000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479469368.0000000000650000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479494441.00000000006B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479694722.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479717139.00000000006BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479735681.00000000006C5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479752843.00000000006C6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479768206.00000000006C7000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479859545.0000000000825000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479878392.0000000000827000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479897179.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479897179.0000000000847000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479944316.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479967918.000000000084F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1479986703.000000000085A000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480002359.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480029584.0000000000876000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480047160.0000000000878000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480065912.0000000000880000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480087108.000000000088A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480118636.000000000089E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480144867.00000000008A1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480165756.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480265384.00000000008AC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480297194.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480388152.00000000008B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480423857.00000000008C4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480719079.00000000008C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480757059.00000000008C6000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1480991867.00000000008CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481107297.00000000008D4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481151864.00000000008DC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481196485.00000000008E4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1481308763.00000000008E6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1482357804.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1482914785.00000000008F7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1484857541.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486198292.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486198292.000000000092A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486710054.0000000000956000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486809740.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486842332.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1486934401.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487022678.000000000095D000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487096641.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000002.00000002.1487209012.000000000096E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_2_2_650000_skotes.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: ___free_lconv_mon
                                                                                                                                                                                                                                                          • String ID: 8"k$`'k
                                                                                                                                                                                                                                                          • API String ID: 3903695350-3309580246
                                                                                                                                                                                                                                                          • Opcode ID: 0544b29493bec4156e4bd832011f74167b77d5d4539cb7de54780aca1ce315b2
                                                                                                                                                                                                                                                          • Instruction ID: 7adc1e6de20a389fabf13bccd710bd58e65c0d17c1a3901a36d4a48d924783ea
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0544b29493bec4156e4bd832011f74167b77d5d4539cb7de54780aca1ce315b2
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0A318B31600201DFEB61BB79D845B9B73EAEF00352F10562EE845D7692DFB0AC80CB55

                                                                                                                                                                                                                                                          Execution Graph

                                                                                                                                                                                                                                                          Execution Coverage:0.9%
                                                                                                                                                                                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                                          Signature Coverage:0%
                                                                                                                                                                                                                                                          Total number of Nodes:607
                                                                                                                                                                                                                                                          Total number of Limit Nodes:4
                                                                                                                                                                                                                                                          execution_graph 10458 659ba5 10459 659ba7 10458->10459 10460 655c10 3 API calls 10459->10460 10461 659cb1 10460->10461 10462 658b30 3 API calls 10461->10462 10463 659cc2 10462->10463 9680 686629 9683 6864c7 9680->9683 9685 6864d5 __cftof 9683->9685 9684 686520 9685->9684 9688 68652b 9685->9688 9687 68652a 9694 68a302 GetPEB 9688->9694 9690 686535 9691 68653a GetPEB 9690->9691 9692 68654a __cftof 9690->9692 9691->9692 9693 686562 ExitProcess 9692->9693 9695 68a31c __cftof 9694->9695 9695->9690 10235 6520a0 10236 66c68b __Mtx_init_in_situ 2 API calls 10235->10236 10237 6520ac 10236->10237 10341 654120 10342 65416a 10341->10342 10344 6541b2 std::invalid_argument::invalid_argument 10342->10344 10345 653ee0 10342->10345 10346 653f1e 10345->10346 10347 653f48 10345->10347 10346->10344 10348 653f58 10347->10348 10351 652c00 10347->10351 10348->10344 10352 652c0e 10351->10352 10358 66b847 10352->10358 10354 652c42 10355 652c49 10354->10355 10364 652c80 10354->10364 10355->10344 10357 652c58 Concurrency::cancel_current_task 10359 66b854 10358->10359 10363 66b873 Concurrency::details::_Reschedule_chore 10358->10363 10367 66cb77 10359->10367 10361 66b864 10361->10363 10369 66b81e 10361->10369 10363->10354 10375 66b7fb 10364->10375 10366 652cb2 shared_ptr 10366->10357 10368 66cb92 CreateThreadpoolWork 10367->10368 10368->10361 10370 66b827 Concurrency::details::_Reschedule_chore 10369->10370 10373 66cdcc 10370->10373 10372 66b841 10372->10363 10374 66cde1 TpPostWork 10373->10374 10374->10372 10376 66b807 10375->10376 10377 66b817 10375->10377 10376->10377 10379 66ca78 10376->10379 10377->10366 10380 66ca8d TpReleaseWork 10379->10380 10380->10377 10413 653fe0 10414 654022 10413->10414 10415 6540d2 10414->10415 10416 65408c 10414->10416 10419 654035 std::invalid_argument::invalid_argument 10414->10419 10417 653ee0 3 API calls 10415->10417 10420 6535e0 10416->10420 10417->10419 10421 653616 10420->10421 10425 65364e Concurrency::cancel_current_task shared_ptr std::invalid_argument::invalid_argument 10421->10425 10426 652ce0 10421->10426 10423 65369e 10424 652c00 3 API calls 10423->10424 10423->10425 10424->10425 10425->10419 10427 652d1d 10426->10427 10428 66bedf InitOnceExecuteOnce 10427->10428 10429 652d46 10428->10429 10430 652d88 10429->10430 10431 652d51 std::invalid_argument::invalid_argument 10429->10431 10435 66bef7 10429->10435 10433 652440 3 API calls 10430->10433 10431->10423 10434 652d9b 10433->10434 10434->10423 10436 66bf03 Concurrency::cancel_current_task 10435->10436 10437 66bf73 10436->10437 10438 66bf6a 10436->10438 10440 652ae0 4 API calls 10437->10440 10442 66be7f 10438->10442 10441 66bf6f 10440->10441 10441->10430 10443 66cc31 InitOnceExecuteOnce 10442->10443 10444 66be97 10443->10444 10445 66be9e 10444->10445 10446 686cbb 3 API calls 10444->10446 10445->10441 10447 66bea7 10446->10447 10447->10441 10238 655cad 10240 655caf __cftof 10238->10240 10239 655d17 shared_ptr std::invalid_argument::invalid_argument 10240->10239 10241 655c10 3 API calls 10240->10241 10242 6566ac 10241->10242 10243 655c10 3 API calls 10242->10243 10244 6566b1 10243->10244 10245 6522c0 3 API calls 10244->10245 10246 6566c9 shared_ptr 10245->10246 10247 655c10 3 API calls 10246->10247 10248 65673d 10247->10248 10249 6522c0 3 API calls 10248->10249 10251 656757 shared_ptr 10249->10251 10250 655c10 3 API calls 10250->10251 10251->10250 10252 6522c0 3 API calls 10251->10252 10253 656852 shared_ptr std::invalid_argument::invalid_argument 10251->10253 10252->10251 9701 654276 9704 652410 9701->9704 9703 65427f 9705 652424 9704->9705 9708 66b52d 9705->9708 9716 683aed 9708->9716 9710 65242a 9710->9703 9711 66b5a5 ___std_exception_copy 9723 66b1ad 9711->9723 9713 66b598 9719 66af56 9713->9719 9727 684f29 9716->9727 9720 66af9f ___std_exception_copy 9719->9720 9722 66afb2 shared_ptr 9720->9722 9765 66b39f 9720->9765 9722->9710 9724 66b1d8 9723->9724 9726 66b1e1 shared_ptr 9723->9726 9725 66b39f 4 API calls 9724->9725 9725->9726 9726->9710 9728 684f2e __cftof 9727->9728 9729 66b555 9728->9729 9733 688bfc __cftof 9728->9733 9734 68d634 9728->9734 9729->9710 9729->9711 9729->9713 9748 6865ed 9733->9748 9736 68d640 __cftof __dosmaperr 9734->9736 9735 68d69c __dosmaperr ___std_exception_copy 9735->9733 9736->9735 9737 68d726 9736->9737 9738 68d81b __cftof 9736->9738 9745 68d751 __cftof 9736->9745 9737->9745 9751 68d62b 9737->9751 9739 6865ed __cftof 3 API calls 9738->9739 9741 68d82e 9739->9741 9744 68d62b __cftof 3 API calls 9744->9745 9745->9735 9746 68d7a5 9745->9746 9754 68a671 9745->9754 9746->9735 9747 68a671 __cftof 3 API calls 9746->9747 9747->9735 9749 6864c7 __cftof 3 API calls 9748->9749 9750 6865fe 9749->9750 9752 68a671 __cftof 3 API calls 9751->9752 9753 68d630 9752->9753 9753->9744 9758 68a67b __dosmaperr ___free_lconv_mon 9754->9758 9755 68a722 9755->9746 9758->9755 9759 688bec 9758->9759 9760 688bf1 __cftof 9759->9760 9761 688bfc __cftof 9760->9761 9762 68d634 __cftof 3 API calls 9760->9762 9763 6865ed __cftof 3 API calls 9761->9763 9762->9761 9764 688c2f 9763->9764 9776 66bedf 9765->9776 9767 66b3e8 9767->9722 9785 66cc31 9776->9785 9779 686cbb 9780 686cc7 __dosmaperr 9779->9780 9781 68a671 __cftof 3 API calls 9780->9781 9784 686ccc 9781->9784 9782 688bec __cftof 3 API calls 9783 686cf6 9782->9783 9784->9782 9786 66b3e1 9785->9786 9787 66cc3f InitOnceExecuteOnce 9785->9787 9786->9767 9786->9779 9787->9786 10254 6542b0 10257 653ac0 10254->10257 10256 6542bb shared_ptr 10258 653af9 10257->10258 10260 6532d0 5 API calls 10258->10260 10261 653c38 10258->10261 10262 653b39 __Cnd_destroy_in_situ shared_ptr __Mtx_destroy_in_situ 10258->10262 10259 6532d0 5 API calls 10264 653c5f 10259->10264 10260->10261 10261->10259 10261->10264 10262->10256 10263 653c68 10263->10256 10264->10263 10265 653810 3 API calls 10264->10265 10266 653cdb shared_ptr 10265->10266 10266->10256 10308 652170 10311 66c6fc 10308->10311 10310 65217a 10312 66c70c 10311->10312 10314 66c724 10311->10314 10312->10314 10315 66cfbe 10312->10315 10314->10310 10316 66ccd5 __Mtx_init_in_situ InitializeCriticalSectionEx 10315->10316 10317 66cfd0 10316->10317 10317->10312 10318 653970 10319 66c68b __Mtx_init_in_situ 2 API calls 10318->10319 10320 6539a7 10319->10320 10321 66c68b __Mtx_init_in_situ 2 API calls 10320->10321 10322 6539e6 10321->10322 10448 6555f0 10449 655610 10448->10449 10450 6522c0 3 API calls 10449->10450 10451 655710 std::invalid_argument::invalid_argument 10449->10451 10450->10449 10452 6543f0 10453 66bedf InitOnceExecuteOnce 10452->10453 10454 65440a 10453->10454 10455 654411 10454->10455 10456 686cbb 3 API calls 10454->10456 10457 654424 10456->10457 10157 669ef0 10158 669f0c 10157->10158 10159 66c68b __Mtx_init_in_situ 2 API calls 10158->10159 10160 669f17 10159->10160 10469 688bbe 10470 688868 3 API calls 10469->10470 10471 688bdc 10470->10471 9794 65cc79 9796 65cc84 shared_ptr 9794->9796 9795 65ccda shared_ptr std::invalid_argument::invalid_argument 9796->9795 9800 655c10 9796->9800 9798 65ce9d 9818 65ca70 9798->9818 9801 655c54 9800->9801 9828 654b30 9801->9828 9803 655d17 shared_ptr std::invalid_argument::invalid_argument 9803->9798 9804 655c7b __cftof 9804->9803 9805 655c10 3 API calls 9804->9805 9806 6566ac 9805->9806 9807 655c10 3 API calls 9806->9807 9808 6566b1 9807->9808 9832 6522c0 9808->9832 9810 6566c9 shared_ptr 9811 655c10 3 API calls 9810->9811 9812 65673d 9811->9812 9813 6522c0 3 API calls 9812->9813 9815 656757 shared_ptr 9813->9815 9814 655c10 3 API calls 9814->9815 9815->9814 9816 6522c0 3 API calls 9815->9816 9817 656852 shared_ptr std::invalid_argument::invalid_argument 9815->9817 9816->9815 9817->9798 9819 65cadd 9818->9819 9820 655c10 3 API calls 9819->9820 9824 65cc87 9819->9824 9822 65ccf9 9820->9822 9821 65ccda shared_ptr std::invalid_argument::invalid_argument 10037 659030 9822->10037 9824->9821 9825 655c10 3 API calls 9824->9825 9826 65ce9d 9825->9826 9827 65ca70 3 API calls 9826->9827 9830 654ce5 9828->9830 9831 654b92 9828->9831 9830->9804 9831->9830 9835 686da6 9831->9835 9921 652280 9832->9921 9836 686dc2 9835->9836 9837 686db4 9835->9837 9836->9831 9840 686d19 9837->9840 9845 68690a 9840->9845 9844 686d3d 9844->9831 9846 68692a 9845->9846 9847 686921 9845->9847 9846->9847 9848 68a671 __cftof 3 API calls 9846->9848 9853 686d52 9847->9853 9849 68694a 9848->9849 9859 68b5fb 9849->9859 9854 686d8f 9853->9854 9856 686d5f 9853->9856 9913 68b67d 9854->9913 9858 686d6e 9856->9858 9908 68b6a1 9856->9908 9858->9844 9860 68b60e 9859->9860 9861 686960 9859->9861 9860->9861 9867 68f5ab 9860->9867 9863 68b628 9861->9863 9864 68b63b 9863->9864 9865 68b650 9863->9865 9864->9865 9874 68e6b1 9864->9874 9865->9847 9868 68f5b7 __dosmaperr 9867->9868 9869 68a671 __cftof 3 API calls 9868->9869 9871 68f5c0 __cftof __dosmaperr 9869->9871 9870 68f606 9870->9861 9871->9870 9872 688bec __cftof 3 API calls 9871->9872 9873 68f62b 9872->9873 9875 68a671 __cftof 3 API calls 9874->9875 9876 68e6bb 9875->9876 9879 68e5c9 9876->9879 9878 68e6c1 9878->9865 9880 68e5d5 __cftof __dosmaperr ___free_lconv_mon 9879->9880 9881 68e5f6 9880->9881 9882 688bec __cftof 3 API calls 9880->9882 9881->9878 9884 68e668 9882->9884 9883 68e6a4 9883->9878 9884->9883 9888 68a72e 9884->9888 9892 68a739 __dosmaperr ___free_lconv_mon 9888->9892 9889 688bec __cftof 3 API calls 9890 68a7c7 9889->9890 9891 68a7be 9893 68e4b0 9891->9893 9892->9889 9892->9891 9894 68e5c9 __cftof 3 API calls 9893->9894 9895 68e4c3 9894->9895 9900 68e259 9895->9900 9897 68e4cb __cftof 9899 68e4dc __cftof __dosmaperr ___free_lconv_mon 9897->9899 9903 68e6c4 9897->9903 9899->9883 9901 68690a __cftof GetPEB ExitProcess GetPEB 9900->9901 9902 68e26b 9901->9902 9902->9897 9904 68e259 __cftof GetPEB ExitProcess GetPEB 9903->9904 9907 68e6e4 __cftof 9904->9907 9905 68e75a __cftof std::invalid_argument::invalid_argument 9905->9899 9906 68e32f __cftof GetPEB ExitProcess GetPEB 9906->9905 9907->9905 9907->9906 9909 68690a __cftof 3 API calls 9908->9909 9911 68b6be 9909->9911 9910 68b6ce std::invalid_argument::invalid_argument 9910->9858 9911->9910 9918 68f1bf 9911->9918 9914 68a671 __cftof 3 API calls 9913->9914 9915 68b688 9914->9915 9916 68b5fb __cftof 3 API calls 9915->9916 9917 68b698 9916->9917 9917->9858 9919 68690a __cftof 3 API calls 9918->9919 9920 68f1df __cftof __freea std::invalid_argument::invalid_argument 9919->9920 9920->9910 9922 652296 9921->9922 9925 6887f8 9922->9925 9928 687609 9925->9928 9927 6522a4 9927->9810 9929 687649 9928->9929 9933 687631 __dosmaperr ___std_exception_copy std::invalid_argument::invalid_argument 9928->9933 9930 68690a __cftof 3 API calls 9929->9930 9929->9933 9931 687661 9930->9931 9934 687bc4 9931->9934 9933->9927 9936 687bd5 9934->9936 9935 687be4 __dosmaperr ___std_exception_copy 9935->9933 9936->9935 9941 688168 9936->9941 9946 687dc2 9936->9946 9951 687de8 9936->9951 9961 687f36 9936->9961 9942 688171 9941->9942 9943 688178 9941->9943 9970 687b50 9942->9970 9943->9936 9945 688177 9945->9936 9947 687dcb 9946->9947 9948 687dd2 9946->9948 9949 687b50 3 API calls 9947->9949 9948->9936 9950 687dd1 9949->9950 9950->9936 9952 687e09 __dosmaperr ___std_exception_copy 9951->9952 9953 687def 9951->9953 9952->9936 9953->9952 9954 687f69 9953->9954 9956 687fa2 9953->9956 9959 687f77 9953->9959 9954->9959 9960 687f8b 9954->9960 9988 688241 9954->9988 9956->9960 9984 688390 9956->9984 9959->9960 9992 6886ea 9959->9992 9960->9936 9962 687f69 9961->9962 9964 687f4f 9961->9964 9965 688241 3 API calls 9962->9965 9968 687f77 9962->9968 9969 687f8b 9962->9969 9963 687fa2 9966 688390 3 API calls 9963->9966 9963->9969 9964->9962 9964->9963 9964->9968 9965->9968 9966->9968 9967 6886ea 3 API calls 9967->9969 9968->9967 9968->9969 9969->9936 9971 687b62 __dosmaperr 9970->9971 9974 688ab6 9971->9974 9973 687b85 __dosmaperr 9973->9945 9975 688ad1 9974->9975 9978 688868 9975->9978 9977 688adb 9977->9973 9979 68887a 9978->9979 9980 68690a __cftof GetPEB ExitProcess GetPEB 9979->9980 9983 68888f __dosmaperr ___std_exception_copy 9979->9983 9982 6888bf 9980->9982 9981 686d52 GetPEB ExitProcess GetPEB 9981->9982 9982->9981 9982->9983 9983->9977 9986 6883ab 9984->9986 9985 6883dd 9985->9959 9986->9985 9996 68c88e 9986->9996 9989 68825a 9988->9989 10003 68d3c8 9989->10003 9991 68830d 9991->9959 9993 68875d std::invalid_argument::invalid_argument 9992->9993 9995 688707 9992->9995 9993->9960 9994 68c88e __cftof 3 API calls 9994->9995 9995->9993 9995->9994 9999 68c733 9996->9999 9998 68c8a6 9998->9985 10000 68c743 9999->10000 10001 68690a __cftof GetPEB ExitProcess GetPEB 10000->10001 10002 68c748 __cftof __dosmaperr ___std_exception_copy 10000->10002 10001->10002 10002->9998 10004 68d3d8 __dosmaperr ___std_exception_copy 10003->10004 10007 68d3ee 10003->10007 10004->9991 10005 68d485 10009 68d4ae 10005->10009 10010 68d4e4 10005->10010 10006 68d48a 10016 68cbdf 10006->10016 10007->10004 10007->10005 10007->10006 10012 68d4cc 10009->10012 10013 68d4b3 10009->10013 10033 68cef8 10010->10033 10029 68d0e2 10012->10029 10022 68d23e 10013->10022 10017 68cbf1 10016->10017 10018 68690a __cftof GetPEB ExitProcess GetPEB 10017->10018 10019 68cc05 10018->10019 10020 68cef8 GetPEB ExitProcess GetPEB 10019->10020 10021 68cc0d __alldvrm __cftof __dosmaperr ___std_exception_copy _strrchr 10019->10021 10020->10021 10021->10004 10025 68d26c 10022->10025 10023 68d2a5 10023->10004 10024 68d2de 10026 68cf9a GetPEB ExitProcess GetPEB 10024->10026 10025->10023 10025->10024 10027 68d2b7 10025->10027 10026->10023 10028 68d16d GetPEB ExitProcess GetPEB 10027->10028 10028->10023 10030 68d10f 10029->10030 10031 68d14e 10030->10031 10032 68d16d GetPEB ExitProcess GetPEB 10030->10032 10031->10004 10032->10031 10034 68cf10 10033->10034 10035 68cf75 10034->10035 10036 68cf9a GetPEB ExitProcess GetPEB 10034->10036 10035->10004 10036->10035 10038 659080 10037->10038 10039 655c10 3 API calls 10038->10039 10040 65909a shared_ptr std::invalid_argument::invalid_argument 10039->10040 10040->9824 10267 659ab8 10269 659acc 10267->10269 10270 659b08 10269->10270 10271 655c10 3 API calls 10270->10271 10272 659b7c 10271->10272 10273 658b30 3 API calls 10272->10273 10274 659b8d 10273->10274 10275 655c10 3 API calls 10274->10275 10276 659cb1 10275->10276 10277 658b30 3 API calls 10276->10277 10278 659cc2 10277->10278 10161 66d0c7 10162 66d0d7 10161->10162 10163 66d17f 10162->10163 10164 66d17b RtlWakeAllConditionVariable 10162->10164 10323 659f44 10324 659f4c shared_ptr 10323->10324 10325 65a953 Sleep CreateMutexA 10324->10325 10326 65a01f shared_ptr 10324->10326 10327 65a98e 10325->10327 10041 653c47 10042 653c51 10041->10042 10045 653c5f 10042->10045 10048 6532d0 10042->10048 10043 653c68 10045->10043 10067 653810 10045->10067 10071 66c6ac 10048->10071 10050 65336b 10077 66c26a 10050->10077 10053 65333c __Mtx_unlock 10054 66c26a 4 API calls 10053->10054 10057 653350 std::invalid_argument::invalid_argument 10053->10057 10055 653377 10054->10055 10058 66c6ac GetSystemTimePreciseAsFileTime 10055->10058 10056 653314 10056->10050 10056->10053 10074 66bd4c 10056->10074 10057->10045 10059 6533af 10058->10059 10060 66c26a 4 API calls 10059->10060 10061 6533b6 __Cnd_broadcast 10059->10061 10060->10061 10062 66c26a 4 API calls 10061->10062 10063 6533d7 __Mtx_unlock 10061->10063 10062->10063 10064 66c26a 4 API calls 10063->10064 10065 6533eb 10063->10065 10066 65340e 10064->10066 10065->10045 10066->10045 10068 65381c 10067->10068 10114 652440 10068->10114 10081 66c452 10071->10081 10073 66c6b9 10073->10056 10098 66bb72 10074->10098 10076 66bd5c 10076->10056 10078 66c274 10077->10078 10079 66c292 10077->10079 10078->10079 10104 66c297 10078->10104 10079->10079 10082 66c4a8 10081->10082 10084 66c47a std::invalid_argument::invalid_argument 10081->10084 10082->10084 10087 66cf6b 10082->10087 10084->10073 10085 66cf6b _xtime_get GetSystemTimePreciseAsFileTime 10086 66c4fd __Xtime_diff_to_millis2 10085->10086 10086->10084 10086->10085 10088 66cf7a 10087->10088 10090 66cf87 __aulldvrm 10087->10090 10088->10090 10091 66cf44 10088->10091 10090->10086 10094 66cbea 10091->10094 10095 66cc07 10094->10095 10096 66cbfb GetSystemTimePreciseAsFileTime 10094->10096 10095->10090 10096->10095 10099 66bb9c 10098->10099 10100 66cf6b _xtime_get GetSystemTimePreciseAsFileTime 10099->10100 10102 66bba4 __Xtime_diff_to_millis2 std::invalid_argument::invalid_argument 10099->10102 10101 66bbcf __Xtime_diff_to_millis2 10100->10101 10101->10102 10103 66cf6b _xtime_get GetSystemTimePreciseAsFileTime 10101->10103 10102->10076 10103->10102 10107 652ae0 10104->10107 10106 66c2ae Concurrency::cancel_current_task 10108 66bedf InitOnceExecuteOnce 10107->10108 10109 652af4 __dosmaperr 10108->10109 10109->10106 10110 68a671 __cftof 3 API calls 10109->10110 10113 686ccc 10110->10113 10111 688bec __cftof 3 API calls 10112 686cf6 10111->10112 10113->10111 10117 66b5d6 10114->10117 10116 652472 10118 66b5f1 Concurrency::cancel_current_task 10117->10118 10119 688bec __cftof 3 API calls 10118->10119 10121 66b658 __cftof std::invalid_argument::invalid_argument 10118->10121 10120 66b69f 10119->10120 10121->10116 10130 652e00 10131 652e28 10130->10131 10134 66c68b 10131->10134 10137 66c3d5 10134->10137 10136 652e33 10138 66c3e1 10137->10138 10139 66c3eb 10137->10139 10140 66c3be 10138->10140 10142 66c39e 10138->10142 10139->10136 10150 66cd0a 10140->10150 10142->10139 10146 66ccd5 10142->10146 10144 66c3d0 10144->10136 10147 66cce3 InitializeCriticalSectionEx 10146->10147 10148 66c3b7 10146->10148 10147->10148 10148->10136 10151 66cd1f RtlInitializeConditionVariable 10150->10151 10151->10144 10168 65e0c0 recv 10169 65e122 recv 10168->10169 10170 65e157 recv 10169->10170 10171 65e191 10170->10171 10172 65e2b3 std::invalid_argument::invalid_argument 10171->10172 10173 66c6ac GetSystemTimePreciseAsFileTime 10171->10173 10174 65e2ee 10173->10174 10175 66c26a 4 API calls 10174->10175 10176 65e358 10175->10176 10177 652ec0 10178 652f06 10177->10178 10183 652f6f 10177->10183 10179 66c6ac GetSystemTimePreciseAsFileTime 10178->10179 10180 652f12 10179->10180 10181 65301e 10180->10181 10185 652f1d __Mtx_unlock 10180->10185 10182 66c26a 4 API calls 10181->10182 10184 653024 10182->10184 10187 66c6ac GetSystemTimePreciseAsFileTime 10183->10187 10196 652fef 10183->10196 10186 66c26a 4 API calls 10184->10186 10185->10183 10185->10184 10188 652fb9 10186->10188 10187->10188 10189 66c26a 4 API calls 10188->10189 10190 652fc0 __Mtx_unlock 10188->10190 10189->10190 10191 66c26a 4 API calls 10190->10191 10192 652fd8 __Cnd_broadcast 10190->10192 10191->10192 10193 66c26a 4 API calls 10192->10193 10192->10196 10194 65303c 10193->10194 10195 66c6ac GetSystemTimePreciseAsFileTime 10194->10195 10206 653080 shared_ptr __Mtx_unlock 10195->10206 10197 6531c5 10198 66c26a 4 API calls 10197->10198 10199 6531cb 10198->10199 10200 66c26a 4 API calls 10199->10200 10201 6531d1 10200->10201 10202 66c26a 4 API calls 10201->10202 10208 653193 __Mtx_unlock 10202->10208 10203 6531a7 std::invalid_argument::invalid_argument 10204 66c26a 4 API calls 10205 6531dd 10204->10205 10206->10197 10206->10199 10206->10203 10207 66c6ac GetSystemTimePreciseAsFileTime 10206->10207 10209 65315f 10207->10209 10208->10203 10208->10204 10209->10197 10209->10201 10209->10208 10210 66bd4c GetSystemTimePreciseAsFileTime 10209->10210 10210->10209 10472 658980 10474 6589d8 shared_ptr 10472->10474 10475 658aea 10472->10475 10473 655c10 3 API calls 10473->10474 10474->10473 10474->10475 10284 653c8e 10285 653c98 10284->10285 10286 652410 4 API calls 10285->10286 10287 653ca5 10285->10287 10286->10287 10288 653810 3 API calls 10287->10288 10289 653ccf 10288->10289 10290 653810 3 API calls 10289->10290 10291 653cdb shared_ptr 10290->10291 10122 686a44 10123 686a5c 10122->10123 10124 686a52 10122->10124 10127 68698d 10123->10127 10126 686a76 ___free_lconv_mon 10128 68690a __cftof 3 API calls 10127->10128 10129 68699f 10128->10129 10129->10126 9696 65a856 9697 65a892 shared_ptr 9696->9697 9699 65a870 9696->9699 9698 65a953 Sleep CreateMutexA 9700 65a98e 9698->9700 9699->9697 9699->9698 10400 652b10 10401 652b1c 10400->10401 10402 652b1a 10400->10402 10403 66c26a 4 API calls 10401->10403 10404 652b22 10403->10404 10476 652b90 10477 652bce 10476->10477 10478 66b7fb TpReleaseWork 10477->10478 10479 652bdb shared_ptr std::invalid_argument::invalid_argument 10478->10479 10405 66d111 10407 66d121 10405->10407 10406 66d12a 10407->10406 10409 66d199 10407->10409 10410 66d1a7 SleepConditionVariableCS 10409->10410 10412 66d1c0 10409->10412 10410->10412 10412->10407 10211 659adc 10212 659aea 10211->10212 10216 659afe shared_ptr 10211->10216 10213 65a917 10212->10213 10212->10216 10214 65a953 Sleep CreateMutexA 10213->10214 10215 65a98e 10214->10215 10217 655c10 3 API calls 10216->10217 10218 659b7c 10217->10218 10225 658b30 10218->10225 10220 659b8d 10221 655c10 3 API calls 10220->10221 10222 659cb1 10221->10222 10223 658b30 3 API calls 10222->10223 10224 659cc2 10223->10224 10226 658b7c 10225->10226 10227 655c10 3 API calls 10226->10227 10229 658b97 shared_ptr 10227->10229 10228 658d01 shared_ptr std::invalid_argument::invalid_argument 10228->10220 10229->10228 10230 655c10 3 API calls 10229->10230 10232 658d9a shared_ptr 10230->10232 10231 658e7e shared_ptr std::invalid_argument::invalid_argument 10231->10220 10232->10231 10233 655c10 3 API calls 10232->10233 10234 658f1a shared_ptr std::invalid_argument::invalid_argument 10233->10234 10234->10220 10480 653f9f 10481 653fb6 10480->10481 10482 653fad 10480->10482 10483 652410 4 API calls 10482->10483 10483->10481 10338 65215a 10339 66c6fc InitializeCriticalSectionEx 10338->10339 10340 652164 10339->10340

                                                                                                                                                                                                                                                          Executed Functions

                                                                                                                                                                                                                                                          Function 0068652B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 342 68652b-686538 call 68a302 345 68655a-68656c call 68656d ExitProcess 342->345 346 68653a-686548 GetPEB 342->346 346->345 347 68654a-686559 346->347 347->345
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • ExitProcess.KERNEL32(?,?,0068652A,?,?,?,?,?,00687661), ref: 00686566
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000003.00000002.1486452961.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Offset: 00650000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486261343.0000000000650000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486452961.00000000006B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486846954.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486935903.00000000006BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487024658.00000000006C5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487174696.00000000006C6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487247912.00000000006C7000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487592488.0000000000825000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487638003.0000000000827000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487717715.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487717715.0000000000847000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487853325.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487884270.000000000084F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487931689.000000000085A000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487961699.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488001447.0000000000876000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488037099.0000000000878000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488065318.0000000000880000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488107501.000000000088A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488152128.000000000089E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488198357.00000000008A1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488231789.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488260232.00000000008AC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488302403.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488344621.00000000008B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488399064.00000000008C4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488429141.00000000008C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488467004.00000000008C6000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488502075.00000000008CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488530915.00000000008D4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488583220.00000000008DC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488619159.00000000008E4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488647288.00000000008E6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488676026.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488706059.00000000008F7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488735170.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488763929.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488763929.000000000092A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488873288.0000000000956000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488909924.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488943713.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488972761.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488991732.000000000095D000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1489019794.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1489045604.000000000096E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_3_2_650000_skotes.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: ExitProcess
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 621844428-0
                                                                                                                                                                                                                                                          • Opcode ID: d330dd8e4ae67eab6cf4ff487a007113d060c30df2f7a2e0bfcde373179c713a
                                                                                                                                                                                                                                                          • Instruction ID: 37d84ec3ec47edc5ec2e65810f16294dc292511eb1c4b11a5868e73f728bef27
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d330dd8e4ae67eab6cf4ff487a007113d060c30df2f7a2e0bfcde373179c713a
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 44E08C30041108AECF257B58C8699983B2AEB82744F000918FE048B225CB25ED82D782
                                                                                                                                                                                                                                                          Function 00659BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140sleepsynchronizationCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • Sleep.KERNELBASE(00000064), ref: 0065A963
                                                                                                                                                                                                                                                          • CreateMutexA.KERNELBASE(00000000,00000000,006B3254), ref: 0065A981
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000003.00000002.1486452961.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Offset: 00650000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486261343.0000000000650000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486452961.00000000006B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486846954.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486935903.00000000006BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487024658.00000000006C5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487174696.00000000006C6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487247912.00000000006C7000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487592488.0000000000825000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487638003.0000000000827000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487717715.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487717715.0000000000847000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487853325.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487884270.000000000084F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487931689.000000000085A000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487961699.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488001447.0000000000876000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488037099.0000000000878000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488065318.0000000000880000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488107501.000000000088A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488152128.000000000089E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488198357.00000000008A1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488231789.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488260232.00000000008AC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488302403.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488344621.00000000008B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488399064.00000000008C4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488429141.00000000008C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488467004.00000000008C6000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488502075.00000000008CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488530915.00000000008D4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488583220.00000000008DC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488619159.00000000008E4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488647288.00000000008E6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488676026.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488706059.00000000008F7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488735170.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488763929.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488763929.000000000092A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488873288.0000000000956000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488909924.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488943713.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488972761.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488991732.000000000095D000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1489019794.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1489045604.000000000096E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_3_2_650000_skotes.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: CreateMutexSleep
                                                                                                                                                                                                                                                          • String ID: T2k
                                                                                                                                                                                                                                                          • API String ID: 1464230837-2749674463
                                                                                                                                                                                                                                                          • Opcode ID: 8f9e80dd2829b8f706f8b65f1669983769f3df03a039468b06d146f41f19f968
                                                                                                                                                                                                                                                          • Instruction ID: 234602abc950da2a0a73c5cb5366f7515af5d4397f0b705da9dbabd52b21ea2e
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8f9e80dd2829b8f706f8b65f1669983769f3df03a039468b06d146f41f19f968
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: DA312771B04200CBEB08AB7CDD857AEB7A3EB85315F244758E814DB3D5C77559888761
                                                                                                                                                                                                                                                          Function 00659F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137sleepsynchronizationCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 22 659f44-659f64 26 659f66-659f72 22->26 27 659f92-659fae 22->27 28 659f74-659f82 26->28 29 659f88-659f8f call 66d663 26->29 30 659fb0-659fbc 27->30 31 659fdc-659ffb 27->31 28->29 32 65a92b 28->32 29->27 34 659fd2-659fd9 call 66d663 30->34 35 659fbe-659fcc 30->35 36 659ffd-65a009 31->36 37 65a029-65a916 call 6680c0 31->37 39 65a953-65a994 Sleep CreateMutexA 32->39 40 65a92b call 686c6a 32->40 34->31 35->32 35->34 43 65a01f-65a026 call 66d663 36->43 44 65a00b-65a019 36->44 52 65a9a7-65a9a8 39->52 53 65a996-65a998 39->53 40->39 43->37 44->32 44->43 53->52 54 65a99a-65a9a5 53->54 54->52
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • Sleep.KERNELBASE(00000064), ref: 0065A963
                                                                                                                                                                                                                                                          • CreateMutexA.KERNELBASE(00000000,00000000,006B3254), ref: 0065A981
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000003.00000002.1486452961.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Offset: 00650000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486261343.0000000000650000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486452961.00000000006B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486846954.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486935903.00000000006BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487024658.00000000006C5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487174696.00000000006C6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487247912.00000000006C7000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487592488.0000000000825000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487638003.0000000000827000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487717715.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487717715.0000000000847000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487853325.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487884270.000000000084F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487931689.000000000085A000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487961699.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488001447.0000000000876000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488037099.0000000000878000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488065318.0000000000880000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488107501.000000000088A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488152128.000000000089E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488198357.00000000008A1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488231789.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488260232.00000000008AC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488302403.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488344621.00000000008B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488399064.00000000008C4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488429141.00000000008C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488467004.00000000008C6000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488502075.00000000008CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488530915.00000000008D4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488583220.00000000008DC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488619159.00000000008E4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488647288.00000000008E6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488676026.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488706059.00000000008F7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488735170.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488763929.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488763929.000000000092A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488873288.0000000000956000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488909924.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488943713.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488972761.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488991732.000000000095D000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1489019794.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1489045604.000000000096E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_3_2_650000_skotes.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: CreateMutexSleep
                                                                                                                                                                                                                                                          • String ID: T2k
                                                                                                                                                                                                                                                          • API String ID: 1464230837-2749674463
                                                                                                                                                                                                                                                          • Opcode ID: c1a637910989642541469be382fd792a9da066dc5b857ae12bde70782768a59e
                                                                                                                                                                                                                                                          • Instruction ID: 14ae9712722720d66f2c08faeb76ba505a4a02cd7e106c2223e8b70864508a31
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c1a637910989642541469be382fd792a9da066dc5b857ae12bde70782768a59e
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: EC312571B102008BEB18ABB8DC857ADB763EF85315F248758E818DB3D5C73599888762
                                                                                                                                                                                                                                                          Function 0065A079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136sleepsynchronizationCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 56 65a079-65a099 60 65a0c7-65a0e3 56->60 61 65a09b-65a0a7 56->61 64 65a0e5-65a0f1 60->64 65 65a111-65a130 60->65 62 65a0bd-65a0c4 call 66d663 61->62 63 65a0a9-65a0b7 61->63 62->60 63->62 66 65a930-65a994 call 686c6a Sleep CreateMutexA 63->66 68 65a107-65a10e call 66d663 64->68 69 65a0f3-65a101 64->69 70 65a132-65a13e 65->70 71 65a15e-65a916 call 6680c0 65->71 86 65a9a7-65a9a8 66->86 87 65a996-65a998 66->87 68->65 69->66 69->68 72 65a154-65a15b call 66d663 70->72 73 65a140-65a14e 70->73 72->71 73->66 73->72 87->86 88 65a99a-65a9a5 87->88 88->86
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • Sleep.KERNELBASE(00000064), ref: 0065A963
                                                                                                                                                                                                                                                          • CreateMutexA.KERNELBASE(00000000,00000000,006B3254), ref: 0065A981
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000003.00000002.1486452961.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Offset: 00650000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486261343.0000000000650000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486452961.00000000006B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486846954.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486935903.00000000006BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487024658.00000000006C5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487174696.00000000006C6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487247912.00000000006C7000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487592488.0000000000825000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487638003.0000000000827000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487717715.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487717715.0000000000847000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487853325.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487884270.000000000084F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487931689.000000000085A000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487961699.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488001447.0000000000876000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488037099.0000000000878000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488065318.0000000000880000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488107501.000000000088A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488152128.000000000089E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488198357.00000000008A1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488231789.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488260232.00000000008AC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488302403.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488344621.00000000008B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488399064.00000000008C4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488429141.00000000008C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488467004.00000000008C6000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488502075.00000000008CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488530915.00000000008D4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488583220.00000000008DC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488619159.00000000008E4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488647288.00000000008E6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488676026.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488706059.00000000008F7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488735170.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488763929.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488763929.000000000092A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488873288.0000000000956000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488909924.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488943713.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488972761.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488991732.000000000095D000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1489019794.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1489045604.000000000096E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_3_2_650000_skotes.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: CreateMutexSleep
                                                                                                                                                                                                                                                          • String ID: T2k
                                                                                                                                                                                                                                                          • API String ID: 1464230837-2749674463
                                                                                                                                                                                                                                                          • Opcode ID: c91de3578263cab4d9d7240b547df096a7c4f611b9756d690a928268fcb0d159
                                                                                                                                                                                                                                                          • Instruction ID: 146911c23f433f21340cbfcdda62ca1339a2fdfa208e1e1f72c736e02bdc4753
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c91de3578263cab4d9d7240b547df096a7c4f611b9756d690a928268fcb0d159
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1E316831B102009BEB18ABBCCD89BADB763DB85315F204758E818DB7D5C73699C88726
                                                                                                                                                                                                                                                          Function 0065A1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135sleepsynchronizationCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 90 65a1ae-65a1ce 94 65a1d0-65a1dc 90->94 95 65a1fc-65a218 90->95 96 65a1f2-65a1f9 call 66d663 94->96 97 65a1de-65a1ec 94->97 98 65a246-65a265 95->98 99 65a21a-65a226 95->99 96->95 97->96 100 65a935 97->100 104 65a267-65a273 98->104 105 65a293-65a916 call 6680c0 98->105 102 65a23c-65a243 call 66d663 99->102 103 65a228-65a236 99->103 107 65a953-65a994 Sleep CreateMutexA 100->107 108 65a935 call 686c6a 100->108 102->98 103->100 103->102 111 65a275-65a283 104->111 112 65a289-65a290 call 66d663 104->112 120 65a9a7-65a9a8 107->120 121 65a996-65a998 107->121 108->107 111->100 111->112 112->105 121->120 122 65a99a-65a9a5 121->122 122->120
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • Sleep.KERNELBASE(00000064), ref: 0065A963
                                                                                                                                                                                                                                                          • CreateMutexA.KERNELBASE(00000000,00000000,006B3254), ref: 0065A981
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000003.00000002.1486452961.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Offset: 00650000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486261343.0000000000650000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486452961.00000000006B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486846954.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486935903.00000000006BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487024658.00000000006C5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487174696.00000000006C6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487247912.00000000006C7000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487592488.0000000000825000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487638003.0000000000827000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487717715.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487717715.0000000000847000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487853325.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487884270.000000000084F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487931689.000000000085A000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487961699.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488001447.0000000000876000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488037099.0000000000878000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488065318.0000000000880000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488107501.000000000088A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488152128.000000000089E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488198357.00000000008A1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488231789.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488260232.00000000008AC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488302403.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488344621.00000000008B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488399064.00000000008C4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488429141.00000000008C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488467004.00000000008C6000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488502075.00000000008CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488530915.00000000008D4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488583220.00000000008DC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488619159.00000000008E4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488647288.00000000008E6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488676026.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488706059.00000000008F7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488735170.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488763929.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488763929.000000000092A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488873288.0000000000956000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488909924.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488943713.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488972761.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488991732.000000000095D000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1489019794.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1489045604.000000000096E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_3_2_650000_skotes.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: CreateMutexSleep
                                                                                                                                                                                                                                                          • String ID: T2k
                                                                                                                                                                                                                                                          • API String ID: 1464230837-2749674463
                                                                                                                                                                                                                                                          • Opcode ID: dc9c02bc5b12fba14a3a35a5e85797682953fac898ce8be05e6f2711c712d4be
                                                                                                                                                                                                                                                          • Instruction ID: 503197a6af3220defb67a87513b99c88bbb8df8dc688abbc8e33b13191e2cb9c
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: dc9c02bc5b12fba14a3a35a5e85797682953fac898ce8be05e6f2711c712d4be
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 56314831B002419BEB18ABBCDC897ADB763AB86311F244759E814DB3D5C7355AC88722
                                                                                                                                                                                                                                                          Function 0065A418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133sleepsynchronizationCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 124 65a418-65a438 128 65a466-65a482 124->128 129 65a43a-65a446 124->129 132 65a484-65a490 128->132 133 65a4b0-65a4cf 128->133 130 65a45c-65a463 call 66d663 129->130 131 65a448-65a456 129->131 130->128 131->130 136 65a93f-65a949 call 686c6a * 2 131->136 138 65a4a6-65a4ad call 66d663 132->138 139 65a492-65a4a0 132->139 134 65a4d1-65a4dd 133->134 135 65a4fd-65a916 call 6680c0 133->135 141 65a4f3-65a4fa call 66d663 134->141 142 65a4df-65a4ed 134->142 155 65a94e 136->155 156 65a949 call 686c6a 136->156 138->133 139->136 139->138 141->135 142->136 142->141 157 65a953-65a994 Sleep CreateMutexA 155->157 158 65a94e call 686c6a 155->158 156->155 160 65a9a7-65a9a8 157->160 161 65a996-65a998 157->161 158->157 161->160 162 65a99a-65a9a5 161->162 162->160
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • Sleep.KERNELBASE(00000064), ref: 0065A963
                                                                                                                                                                                                                                                          • CreateMutexA.KERNELBASE(00000000,00000000,006B3254), ref: 0065A981
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000003.00000002.1486452961.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Offset: 00650000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486261343.0000000000650000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486452961.00000000006B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486846954.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486935903.00000000006BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487024658.00000000006C5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487174696.00000000006C6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487247912.00000000006C7000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487592488.0000000000825000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487638003.0000000000827000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487717715.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487717715.0000000000847000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487853325.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487884270.000000000084F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487931689.000000000085A000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487961699.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488001447.0000000000876000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488037099.0000000000878000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488065318.0000000000880000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488107501.000000000088A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488152128.000000000089E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488198357.00000000008A1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488231789.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488260232.00000000008AC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488302403.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488344621.00000000008B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488399064.00000000008C4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488429141.00000000008C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488467004.00000000008C6000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488502075.00000000008CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488530915.00000000008D4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488583220.00000000008DC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488619159.00000000008E4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488647288.00000000008E6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488676026.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488706059.00000000008F7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488735170.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488763929.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488763929.000000000092A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488873288.0000000000956000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488909924.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488943713.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488972761.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488991732.000000000095D000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1489019794.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1489045604.000000000096E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_3_2_650000_skotes.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: CreateMutexSleep
                                                                                                                                                                                                                                                          • String ID: T2k
                                                                                                                                                                                                                                                          • API String ID: 1464230837-2749674463
                                                                                                                                                                                                                                                          • Opcode ID: fe0f17f494cf076dfb6a05fafe683ca91c7879c78f5f02c42188989c3715ace3
                                                                                                                                                                                                                                                          • Instruction ID: 715e19086d182651c41d4143239aa4279f227211cfeb7ac516e766cb9bbea982
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: fe0f17f494cf076dfb6a05fafe683ca91c7879c78f5f02c42188989c3715ace3
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C0312531B001009BEB08ABFCD889BADB6A3EF85315F20475CE814DB3D5D77559C88766
                                                                                                                                                                                                                                                          Function 0065A54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132sleepsynchronizationCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 164 65a54d-65a56d 168 65a56f-65a57b 164->168 169 65a59b-65a5b7 164->169 170 65a591-65a598 call 66d663 168->170 171 65a57d-65a58b 168->171 172 65a5e5-65a604 169->172 173 65a5b9-65a5c5 169->173 170->169 171->170 176 65a944-65a949 call 686c6a 171->176 174 65a606-65a612 172->174 175 65a632-65a916 call 6680c0 172->175 178 65a5c7-65a5d5 173->178 179 65a5db-65a5e2 call 66d663 173->179 182 65a614-65a622 174->182 183 65a628-65a62f call 66d663 174->183 190 65a94e 176->190 191 65a949 call 686c6a 176->191 178->176 178->179 179->172 182->176 182->183 183->175 194 65a953-65a994 Sleep CreateMutexA 190->194 195 65a94e call 686c6a 190->195 191->190 198 65a9a7-65a9a8 194->198 199 65a996-65a998 194->199 195->194 199->198 200 65a99a-65a9a5 199->200 200->198
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • Sleep.KERNELBASE(00000064), ref: 0065A963
                                                                                                                                                                                                                                                          • CreateMutexA.KERNELBASE(00000000,00000000,006B3254), ref: 0065A981
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000003.00000002.1486452961.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Offset: 00650000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486261343.0000000000650000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486452961.00000000006B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486846954.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486935903.00000000006BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487024658.00000000006C5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487174696.00000000006C6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487247912.00000000006C7000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487592488.0000000000825000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487638003.0000000000827000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487717715.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487717715.0000000000847000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487853325.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487884270.000000000084F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487931689.000000000085A000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487961699.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488001447.0000000000876000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488037099.0000000000878000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488065318.0000000000880000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488107501.000000000088A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488152128.000000000089E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488198357.00000000008A1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488231789.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488260232.00000000008AC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488302403.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488344621.00000000008B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488399064.00000000008C4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488429141.00000000008C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488467004.00000000008C6000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488502075.00000000008CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488530915.00000000008D4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488583220.00000000008DC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488619159.00000000008E4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488647288.00000000008E6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488676026.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488706059.00000000008F7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488735170.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488763929.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488763929.000000000092A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488873288.0000000000956000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488909924.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488943713.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488972761.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488991732.000000000095D000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1489019794.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1489045604.000000000096E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_3_2_650000_skotes.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: CreateMutexSleep
                                                                                                                                                                                                                                                          • String ID: T2k
                                                                                                                                                                                                                                                          • API String ID: 1464230837-2749674463
                                                                                                                                                                                                                                                          • Opcode ID: 48b92637382b15699b74a15b220fc2ea40e614d3d60287906242e3bd1a3d25e0
                                                                                                                                                                                                                                                          • Instruction ID: 0470ba68e57ee2cf243d1e546a94d8a6557efb4afb77d4ff94f94dae10c9f53f
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 48b92637382b15699b74a15b220fc2ea40e614d3d60287906242e3bd1a3d25e0
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C7313571B001008BEB08ABB8CC89BADB763EBC5325F244758E854DB3D5D73599888726
                                                                                                                                                                                                                                                          Function 0065A682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131sleepsynchronizationCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 202 65a682-65a6a2 206 65a6a4-65a6b0 202->206 207 65a6d0-65a6ec 202->207 208 65a6c6-65a6cd call 66d663 206->208 209 65a6b2-65a6c0 206->209 210 65a6ee-65a6fa 207->210 211 65a71a-65a739 207->211 208->207 209->208 216 65a949 209->216 212 65a710-65a717 call 66d663 210->212 213 65a6fc-65a70a 210->213 214 65a767-65a916 call 6680c0 211->214 215 65a73b-65a747 211->215 212->211 213->212 213->216 221 65a75d-65a764 call 66d663 215->221 222 65a749-65a757 215->222 219 65a94e 216->219 220 65a949 call 686c6a 216->220 226 65a953-65a994 Sleep CreateMutexA 219->226 227 65a94e call 686c6a 219->227 220->219 221->214 222->216 222->221 234 65a9a7-65a9a8 226->234 235 65a996-65a998 226->235 227->226 235->234 236 65a99a-65a9a5 235->236 236->234
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • Sleep.KERNELBASE(00000064), ref: 0065A963
                                                                                                                                                                                                                                                          • CreateMutexA.KERNELBASE(00000000,00000000,006B3254), ref: 0065A981
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000003.00000002.1486452961.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Offset: 00650000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486261343.0000000000650000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486452961.00000000006B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486846954.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486935903.00000000006BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487024658.00000000006C5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487174696.00000000006C6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487247912.00000000006C7000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487592488.0000000000825000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487638003.0000000000827000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487717715.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487717715.0000000000847000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487853325.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487884270.000000000084F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487931689.000000000085A000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487961699.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488001447.0000000000876000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488037099.0000000000878000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488065318.0000000000880000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488107501.000000000088A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488152128.000000000089E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488198357.00000000008A1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488231789.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488260232.00000000008AC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488302403.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488344621.00000000008B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488399064.00000000008C4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488429141.00000000008C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488467004.00000000008C6000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488502075.00000000008CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488530915.00000000008D4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488583220.00000000008DC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488619159.00000000008E4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488647288.00000000008E6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488676026.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488706059.00000000008F7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488735170.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488763929.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488763929.000000000092A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488873288.0000000000956000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488909924.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488943713.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488972761.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488991732.000000000095D000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1489019794.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1489045604.000000000096E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_3_2_650000_skotes.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: CreateMutexSleep
                                                                                                                                                                                                                                                          • String ID: T2k
                                                                                                                                                                                                                                                          • API String ID: 1464230837-2749674463
                                                                                                                                                                                                                                                          • Opcode ID: f4c5a00c5f8709343560dd5369aa4ad802301e2d6b92ac8d87fdff664ffcdf58
                                                                                                                                                                                                                                                          • Instruction ID: 94a12dcda9b0abedefbc2a9372294906659939c7d83d527410b41131319a6124
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f4c5a00c5f8709343560dd5369aa4ad802301e2d6b92ac8d87fdff664ffcdf58
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6F314A71B002008BEB08EBBCDD857ADB763EBC5315F244758E814DB3D5C73559888766
                                                                                                                                                                                                                                                          Function 00659ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107sleepsynchronizationCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 238 659adc-659ae8 239 659afe-659d91 call 66d663 call 667a00 call 655c10 call 658b30 call 668220 call 667a00 call 655c10 call 658b30 call 668220 238->239 240 659aea-659af8 238->240 240->239 241 65a917 240->241 244 65a953-65a994 Sleep CreateMutexA 241->244 245 65a917 call 686c6a 241->245 250 65a9a7-65a9a8 244->250 251 65a996-65a998 244->251 245->244 251->250 253 65a99a-65a9a5 251->253 253->250
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • Sleep.KERNELBASE(00000064), ref: 0065A963
                                                                                                                                                                                                                                                          • CreateMutexA.KERNELBASE(00000000,00000000,006B3254), ref: 0065A981
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000003.00000002.1486452961.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Offset: 00650000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486261343.0000000000650000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486452961.00000000006B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486846954.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486935903.00000000006BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487024658.00000000006C5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487174696.00000000006C6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487247912.00000000006C7000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487592488.0000000000825000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487638003.0000000000827000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487717715.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487717715.0000000000847000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487853325.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487884270.000000000084F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487931689.000000000085A000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487961699.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488001447.0000000000876000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488037099.0000000000878000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488065318.0000000000880000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488107501.000000000088A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488152128.000000000089E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488198357.00000000008A1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488231789.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488260232.00000000008AC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488302403.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488344621.00000000008B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488399064.00000000008C4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488429141.00000000008C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488467004.00000000008C6000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488502075.00000000008CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488530915.00000000008D4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488583220.00000000008DC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488619159.00000000008E4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488647288.00000000008E6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488676026.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488706059.00000000008F7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488735170.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488763929.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488763929.000000000092A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488873288.0000000000956000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488909924.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488943713.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488972761.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488991732.000000000095D000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1489019794.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1489045604.000000000096E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_3_2_650000_skotes.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: CreateMutexSleep
                                                                                                                                                                                                                                                          • String ID: T2k
                                                                                                                                                                                                                                                          • API String ID: 1464230837-2749674463
                                                                                                                                                                                                                                                          • Opcode ID: c486ddfd57c85e9a0b40eef4ac346d2d8e42991f596077249a15f784abfaed9c
                                                                                                                                                                                                                                                          • Instruction ID: 5fe1da54a9ab8bc6ebb8f61f5708c7df566c680d95a6d018b81081dde18becaf
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c486ddfd57c85e9a0b40eef4ac346d2d8e42991f596077249a15f784abfaed9c
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0D214531B042009BFB18AB6CDC8576DB763EBC1311F204758E808C77E5C7755A848B22
                                                                                                                                                                                                                                                          Function 0065A856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100sleepsynchronizationCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 306 65a856-65a86e 307 65a870-65a87c 306->307 308 65a89c-65a89e 306->308 311 65a892-65a899 call 66d663 307->311 312 65a87e-65a88c 307->312 309 65a8a0-65a8a7 308->309 310 65a8a9-65a8b1 call 657d30 308->310 313 65a8eb-65a916 call 6680c0 309->313 322 65a8e4-65a8e6 310->322 323 65a8b3-65a8bb call 657d30 310->323 311->308 312->311 315 65a94e 312->315 318 65a953-65a987 Sleep CreateMutexA 315->318 319 65a94e call 686c6a 315->319 326 65a98e-65a994 318->326 319->318 322->313 323->322 330 65a8bd-65a8c5 call 657d30 323->330 328 65a9a7-65a9a8 326->328 329 65a996-65a998 326->329 329->328 331 65a99a-65a9a5 329->331 330->322 335 65a8c7-65a8cf call 657d30 330->335 331->328 335->322 338 65a8d1-65a8d9 call 657d30 335->338 338->322 341 65a8db-65a8e2 338->341 341->313
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • Sleep.KERNELBASE(00000064), ref: 0065A963
                                                                                                                                                                                                                                                          • CreateMutexA.KERNELBASE(00000000,00000000,006B3254), ref: 0065A981
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000003.00000002.1486452961.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Offset: 00650000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486261343.0000000000650000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486452961.00000000006B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486846954.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486935903.00000000006BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487024658.00000000006C5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487174696.00000000006C6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487247912.00000000006C7000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487592488.0000000000825000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487638003.0000000000827000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487717715.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487717715.0000000000847000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487853325.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487884270.000000000084F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487931689.000000000085A000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487961699.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488001447.0000000000876000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488037099.0000000000878000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488065318.0000000000880000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488107501.000000000088A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488152128.000000000089E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488198357.00000000008A1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488231789.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488260232.00000000008AC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488302403.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488344621.00000000008B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488399064.00000000008C4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488429141.00000000008C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488467004.00000000008C6000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488502075.00000000008CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488530915.00000000008D4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488583220.00000000008DC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488619159.00000000008E4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488647288.00000000008E6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488676026.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488706059.00000000008F7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488735170.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488763929.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488763929.000000000092A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488873288.0000000000956000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488909924.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488943713.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488972761.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488991732.000000000095D000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1489019794.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1489045604.000000000096E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_3_2_650000_skotes.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: CreateMutexSleep
                                                                                                                                                                                                                                                          • String ID: T2k
                                                                                                                                                                                                                                                          • API String ID: 1464230837-2749674463
                                                                                                                                                                                                                                                          • Opcode ID: c0d38f20d736b9264dfd2c28d832d4b650f76330498e0bd4f77904017d990c87
                                                                                                                                                                                                                                                          • Instruction ID: c7c2bb234ae098885bc4dc975f72acce54867d43c44cd2ef7b40f0bddb312b13
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c0d38f20d736b9264dfd2c28d832d4b650f76330498e0bd4f77904017d990c87
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 86214F717442029AFB2477EC989677DB363DF81302F240B1AEE04D73D1CA7659C98257
                                                                                                                                                                                                                                                          Function 0065A34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100sleepsynchronizationCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 283 65a34f-65a35b 284 65a371-65a39a call 66d663 283->284 285 65a35d-65a36b 283->285 291 65a39c-65a3a8 284->291 292 65a3c8-65a916 call 6680c0 284->292 285->284 286 65a93a 285->286 289 65a953-65a994 Sleep CreateMutexA 286->289 290 65a93a call 686c6a 286->290 299 65a9a7-65a9a8 289->299 300 65a996-65a998 289->300 290->289 293 65a3be-65a3c5 call 66d663 291->293 294 65a3aa-65a3b8 291->294 293->292 294->286 294->293 300->299 303 65a99a-65a9a5 300->303 303->299
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • Sleep.KERNELBASE(00000064), ref: 0065A963
                                                                                                                                                                                                                                                          • CreateMutexA.KERNELBASE(00000000,00000000,006B3254), ref: 0065A981
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000003.00000002.1486452961.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Offset: 00650000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486261343.0000000000650000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486452961.00000000006B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486846954.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486935903.00000000006BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487024658.00000000006C5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487174696.00000000006C6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487247912.00000000006C7000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487592488.0000000000825000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487638003.0000000000827000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487717715.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487717715.0000000000847000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487853325.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487884270.000000000084F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487931689.000000000085A000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487961699.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488001447.0000000000876000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488037099.0000000000878000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488065318.0000000000880000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488107501.000000000088A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488152128.000000000089E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488198357.00000000008A1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488231789.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488260232.00000000008AC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488302403.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488344621.00000000008B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488399064.00000000008C4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488429141.00000000008C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488467004.00000000008C6000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488502075.00000000008CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488530915.00000000008D4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488583220.00000000008DC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488619159.00000000008E4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488647288.00000000008E6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488676026.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488706059.00000000008F7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488735170.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488763929.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488763929.000000000092A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488873288.0000000000956000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488909924.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488943713.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488972761.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488991732.000000000095D000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1489019794.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1489045604.000000000096E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_3_2_650000_skotes.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: CreateMutexSleep
                                                                                                                                                                                                                                                          • String ID: T2k
                                                                                                                                                                                                                                                          • API String ID: 1464230837-2749674463
                                                                                                                                                                                                                                                          • Opcode ID: d2b3bb9c042feffde2eeffca41a667e09ebd2e3adbc4a073a11c325a335b78ee
                                                                                                                                                                                                                                                          • Instruction ID: 80e96229a08d402128efac2784da921e642c1ccfd6ae3c11d82412504641be60
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d2b3bb9c042feffde2eeffca41a667e09ebd2e3adbc4a073a11c325a335b78ee
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 202167717042009BEB08ABACDC8576DB763DBD1316F24475DE808D77D4C7355AC88762

                                                                                                                                                                                                                                                          Non-executed Functions

                                                                                                                                                                                                                                                          Function 0068CBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000003.00000002.1486452961.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Offset: 00650000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486261343.0000000000650000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486452961.00000000006B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486846954.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486935903.00000000006BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487024658.00000000006C5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487174696.00000000006C6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487247912.00000000006C7000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487592488.0000000000825000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487638003.0000000000827000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487717715.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487717715.0000000000847000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487853325.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487884270.000000000084F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487931689.000000000085A000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487961699.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488001447.0000000000876000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488037099.0000000000878000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488065318.0000000000880000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488107501.000000000088A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488152128.000000000089E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488198357.00000000008A1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488231789.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488260232.00000000008AC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488302403.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488344621.00000000008B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488399064.00000000008C4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488429141.00000000008C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488467004.00000000008C6000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488502075.00000000008CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488530915.00000000008D4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488583220.00000000008DC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488619159.00000000008E4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488647288.00000000008E6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488676026.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488706059.00000000008F7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488735170.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488763929.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488763929.000000000092A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488873288.0000000000956000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488909924.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488943713.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488972761.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488991732.000000000095D000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1489019794.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1489045604.000000000096E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_3_2_650000_skotes.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: _strrchr
                                                                                                                                                                                                                                                          • String ID: vh
                                                                                                                                                                                                                                                          • API String ID: 3213747228-3728581510
                                                                                                                                                                                                                                                          • Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
                                                                                                                                                                                                                                                          • Instruction ID: fe6d98c549092f4fa220c858e2a3edded7231bde7c80a2afe9644c7fd7c9a67b
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CAB128329046459FDB15EF28C881BFEBBE6EF45360F1442A9E855EB342D6349D02CBB4
                                                                                                                                                                                                                                                          Function 00652EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000003.00000002.1486452961.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Offset: 00650000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486261343.0000000000650000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486452961.00000000006B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486846954.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486935903.00000000006BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487024658.00000000006C5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487174696.00000000006C6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487247912.00000000006C7000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487592488.0000000000825000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487638003.0000000000827000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487717715.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487717715.0000000000847000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487853325.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487884270.000000000084F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487931689.000000000085A000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487961699.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488001447.0000000000876000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488037099.0000000000878000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488065318.0000000000880000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488107501.000000000088A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488152128.000000000089E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488198357.00000000008A1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488231789.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488260232.00000000008AC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488302403.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488344621.00000000008B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488399064.00000000008C4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488429141.00000000008C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488467004.00000000008C6000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488502075.00000000008CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488530915.00000000008D4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488583220.00000000008DC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488619159.00000000008E4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488647288.00000000008E6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488676026.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488706059.00000000008F7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488735170.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488763929.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488763929.000000000092A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488873288.0000000000956000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488909924.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488943713.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488972761.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488991732.000000000095D000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1489019794.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1489045604.000000000096E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_3_2_650000_skotes.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: Mtx_unlock$Cnd_broadcast
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 32384418-0
                                                                                                                                                                                                                                                          • Opcode ID: c6df6624782e090c889877462fcabf9a4526e2d1fa78db3e41b9e9fdf166975d
                                                                                                                                                                                                                                                          • Instruction ID: e1127944055078ddcb710b970a884eeb44b1d4b3ff30977a67cc94ab5c8d86ed
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c6df6624782e090c889877462fcabf9a4526e2d1fa78db3e41b9e9fdf166975d
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CCA1D170A01B259FDB20DF75C9447AAB7AAFF15761F044129EC15D7381EB31EA08CB91
                                                                                                                                                                                                                                                          Function 0066BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000003.00000002.1486452961.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Offset: 00650000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486261343.0000000000650000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486452961.00000000006B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486846954.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486935903.00000000006BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487024658.00000000006C5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487174696.00000000006C6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487247912.00000000006C7000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487592488.0000000000825000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487638003.0000000000827000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487717715.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487717715.0000000000847000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487853325.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487884270.000000000084F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487931689.000000000085A000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487961699.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488001447.0000000000876000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488037099.0000000000878000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488065318.0000000000880000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488107501.000000000088A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488152128.000000000089E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488198357.00000000008A1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488231789.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488260232.00000000008AC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488302403.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488344621.00000000008B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488399064.00000000008C4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488429141.00000000008C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488467004.00000000008C6000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488502075.00000000008CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488530915.00000000008D4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488583220.00000000008DC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488619159.00000000008E4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488647288.00000000008E6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488676026.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488706059.00000000008F7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488735170.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488763929.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488763929.000000000092A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488873288.0000000000956000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488909924.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488943713.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488972761.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488991732.000000000095D000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1489019794.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1489045604.000000000096E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_3_2_650000_skotes.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: Xtime_diff_to_millis2_xtime_get
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 531285432-0
                                                                                                                                                                                                                                                          • Opcode ID: 9f61e8e6b0e53be6efeaaa9d483f8e2883c0261a9c11400f1744eaf37835e74b
                                                                                                                                                                                                                                                          • Instruction ID: 58d035d04f7a2f15712b2e4416efa682ea8a0afabf27dc0d5ae7064227268655
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9f61e8e6b0e53be6efeaaa9d483f8e2883c0261a9c11400f1744eaf37835e74b
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3A216271A00619AFDF40EFA4CC959BEB7BAEF08720F101019F501F7251DB30AE419BA4
                                                                                                                                                                                                                                                          Function 0068F35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 00000003.00000002.1486452961.0000000000651000.00000040.00000001.01000000.00000007.sdmp, Offset: 00650000, based on PE: true
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486261343.0000000000650000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486452961.00000000006B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486846954.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1486935903.00000000006BB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487024658.00000000006C5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487174696.00000000006C6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487247912.00000000006C7000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487592488.0000000000825000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487638003.0000000000827000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487717715.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487717715.0000000000847000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487853325.000000000084E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487884270.000000000084F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487931689.000000000085A000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1487961699.000000000085F000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488001447.0000000000876000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488037099.0000000000878000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488065318.0000000000880000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488107501.000000000088A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488152128.000000000089E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488198357.00000000008A1000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488231789.00000000008A2000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488260232.00000000008AC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488302403.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488344621.00000000008B2000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488399064.00000000008C4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488429141.00000000008C5000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488467004.00000000008C6000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488502075.00000000008CB000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488530915.00000000008D4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488583220.00000000008DC000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488619159.00000000008E4000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488647288.00000000008E6000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488676026.00000000008F5000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488706059.00000000008F7000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488735170.0000000000904000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488763929.0000000000906000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488763929.000000000092A000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488873288.0000000000956000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488909924.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488943713.0000000000958000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488972761.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1488991732.000000000095D000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1489019794.000000000096C000.00000040.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          • Associated: 00000003.00000002.1489045604.000000000096E000.00000080.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_3_2_650000_skotes.jbxd
                                                                                                                                                                                                                                                          Yara matches
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: ___free_lconv_mon
                                                                                                                                                                                                                                                          • String ID: 8"k$`'k
                                                                                                                                                                                                                                                          • API String ID: 3903695350-3309580246
                                                                                                                                                                                                                                                          • Opcode ID: 0544b29493bec4156e4bd832011f74167b77d5d4539cb7de54780aca1ce315b2
                                                                                                                                                                                                                                                          • Instruction ID: 7adc1e6de20a389fabf13bccd710bd58e65c0d17c1a3901a36d4a48d924783ea
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0544b29493bec4156e4bd832011f74167b77d5d4539cb7de54780aca1ce315b2
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0A318B31600201DFEB61BB79D845B9B73EAEF00352F10562EE845D7692DFB0AC80CB55

                                                                                                                                                                                                                                                          Execution Graph

                                                                                                                                                                                                                                                          Execution Coverage:8.7%
                                                                                                                                                                                                                                                          Dynamic/Decrypted Code Coverage:100%
                                                                                                                                                                                                                                                          Signature Coverage:0%
                                                                                                                                                                                                                                                          Total number of Nodes:13
                                                                                                                                                                                                                                                          Total number of Limit Nodes:1
                                                                                                                                                                                                                                                          execution_graph 1752 28609e0 1755 28609e4 1752->1755 1753 2860a64 1755->1753 1756 2860668 1755->1756 1757 28629f0 VirtualProtect 1756->1757 1759 2862a78 1757->1759 1759->1753 1760 28d8162 1761 28d817c CreateProcessW VirtualAlloc Wow64GetThreadContext ReadProcessMemory VirtualAllocEx 1760->1761 1762 28d8223 WriteProcessMemory 1761->1762 1766 28d812b GetPEB 1761->1766 1763 28d8268 1762->1763 1764 28d826d WriteProcessMemory 1763->1764 1765 28d82aa WriteProcessMemory Wow64SetThreadContext ResumeThread 1763->1765 1764->1763 1766->1761

                                                                                                                                                                                                                                                          Executed Functions

                                                                                                                                                                                                                                                          Function 028D7FE5 Relevance: 40.5, APIs: 10, Strings: 13, Instructions: 294threadinjectionmemoryCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,028D7F57,028D7F47), ref: 028D817D
                                                                                                                                                                                                                                                          • VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 028D8190
                                                                                                                                                                                                                                                          • Wow64GetThreadContext.KERNEL32(0000009C,00000000), ref: 028D81AE
                                                                                                                                                                                                                                                          • ReadProcessMemory.KERNELBASE(00000098,?,028D7F9B,00000004,00000000), ref: 028D81D2
                                                                                                                                                                                                                                                          • VirtualAllocEx.KERNELBASE(00000098,?,?,00003000,00000040), ref: 028D81FD
                                                                                                                                                                                                                                                          • WriteProcessMemory.KERNELBASE(00000098,00000000,?,?,00000000,?), ref: 028D8255
                                                                                                                                                                                                                                                          • WriteProcessMemory.KERNELBASE(00000098,00400000,?,?,00000000,?,00000028), ref: 028D82A0
                                                                                                                                                                                                                                                          • WriteProcessMemory.KERNELBASE(00000098,?,?,00000004,00000000), ref: 028D82DE
                                                                                                                                                                                                                                                          • Wow64SetThreadContext.KERNEL32(0000009C,04E50000), ref: 028D831A
                                                                                                                                                                                                                                                          • ResumeThread.KERNELBASE(0000009C), ref: 028D8329
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000B.00000002.2224056364.00000000028D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 028D7000, based on PE: false
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_11_2_28d7000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
                                                                                                                                                                                                                                                          • String ID: CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
                                                                                                                                                                                                                                                          • API String ID: 2687962208-232383841
                                                                                                                                                                                                                                                          • Opcode ID: 956aea2136c6b0205ab5bf3fe1e0123e9091b05b22cf94d50ecc47fa332fbd9d
                                                                                                                                                                                                                                                          • Instruction ID: a7463457959ee13f70ff393ee0648cb8372855fe57abfea13274d68fe2c01d22
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 956aea2136c6b0205ab5bf3fe1e0123e9091b05b22cf94d50ecc47fa332fbd9d
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A0B1E57664064AAFDB60CF68CC80BDA73A5FF88714F158124EA08EB341D774FA56CB94
                                                                                                                                                                                                                                                          Function 028D8162 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82threadinjectionmemoryCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,028D7F57,028D7F47), ref: 028D817D
                                                                                                                                                                                                                                                          • VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 028D8190
                                                                                                                                                                                                                                                          • Wow64GetThreadContext.KERNEL32(0000009C,00000000), ref: 028D81AE
                                                                                                                                                                                                                                                          • ReadProcessMemory.KERNELBASE(00000098,?,028D7F9B,00000004,00000000), ref: 028D81D2
                                                                                                                                                                                                                                                          • VirtualAllocEx.KERNELBASE(00000098,?,?,00003000,00000040), ref: 028D81FD
                                                                                                                                                                                                                                                          • WriteProcessMemory.KERNELBASE(00000098,00000000,?,?,00000000,?), ref: 028D8255
                                                                                                                                                                                                                                                          • WriteProcessMemory.KERNELBASE(00000098,00400000,?,?,00000000,?,00000028), ref: 028D82A0
                                                                                                                                                                                                                                                          • WriteProcessMemory.KERNELBASE(00000098,?,?,00000004,00000000), ref: 028D82DE
                                                                                                                                                                                                                                                          • Wow64SetThreadContext.KERNEL32(0000009C,04E50000), ref: 028D831A
                                                                                                                                                                                                                                                          • ResumeThread.KERNELBASE(0000009C), ref: 028D8329
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000B.00000002.2224056364.00000000028D7000.00000040.00000800.00020000.00000000.sdmp, Offset: 028D7000, based on PE: false
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_11_2_28d7000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
                                                                                                                                                                                                                                                          • String ID: TerminateProcess
                                                                                                                                                                                                                                                          • API String ID: 2687962208-2873147277
                                                                                                                                                                                                                                                          • Opcode ID: 366357b1f1c2220b0d4ba716667a9fb5a6f16c59ad58adbe506062085bfa29f6
                                                                                                                                                                                                                                                          • Instruction ID: 969295adb6832cda860f96f5cd5066332328717712fc8f4c93b02fede641212d
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 366357b1f1c2220b0d4ba716667a9fb5a6f16c59ad58adbe506062085bfa29f6
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 54312F76640646EBDB34CF54CC51FEA7365BFC8B15F148508FB09AF280C6B4BA058B94
                                                                                                                                                                                                                                                          Function 02860668 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 36 2860668-2862a76 VirtualProtect 39 2862a7d-2862a91 36->39 40 2862a78 36->40 40->39
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • VirtualProtect.KERNELBASE(038D3588,?,?,?), ref: 02862A69
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000B.00000002.2223590893.0000000002860000.00000040.00000800.00020000.00000000.sdmp, Offset: 02860000, based on PE: false
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_11_2_2860000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: ProtectVirtual
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 544645111-0
                                                                                                                                                                                                                                                          • Opcode ID: b2fa9eed1be34ff19bb351cfd65a6b18a8d6f6978030c0ae4e8994d433074eb7
                                                                                                                                                                                                                                                          • Instruction ID: 68c3c36e376953d627c06c64008991c8c6254759e71a155d94d2766f85403d00
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b2fa9eed1be34ff19bb351cfd65a6b18a8d6f6978030c0ae4e8994d433074eb7
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3421E5B5D00619AFDB10DF99D884ADEFBB4FB48310F10816AE918A7240C3756954CBA5
                                                                                                                                                                                                                                                          Function 028629EF Relevance: 1.6, APIs: 1, Instructions: 51memoryCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 41 28629ef-2862a76 VirtualProtect 43 2862a7d-2862a91 41->43 44 2862a78 41->44 44->43
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • VirtualProtect.KERNELBASE(038D3588,?,?,?), ref: 02862A69
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000B.00000002.2223590893.0000000002860000.00000040.00000800.00020000.00000000.sdmp, Offset: 02860000, based on PE: false
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_11_2_2860000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: ProtectVirtual
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 544645111-0
                                                                                                                                                                                                                                                          • Opcode ID: 2b3bc31c4296aa75ad3adcdbbe30936f9838f64bc9d17c0c8717f881327a6d88
                                                                                                                                                                                                                                                          • Instruction ID: 7454c22a0e12273b95f2d40e680f9da2716fcca6e2d4cb8fc631f4a3b4b30645
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2b3bc31c4296aa75ad3adcdbbe30936f9838f64bc9d17c0c8717f881327a6d88
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F32114B5D01219AFCB10CF9AD884ADEFBB4FF48310F10812AE918A7300C3B5A954CFA5

                                                                                                                                                                                                                                                          Execution Graph

                                                                                                                                                                                                                                                          Execution Coverage:9%
                                                                                                                                                                                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                                          Signature Coverage:27.8%
                                                                                                                                                                                                                                                          Total number of Nodes:187
                                                                                                                                                                                                                                                          Total number of Limit Nodes:14
                                                                                                                                                                                                                                                          execution_graph 14145 4423c5 GetForegroundWindow 14149 444110 14145->14149 14147 4423d1 GetForegroundWindow 14148 4423ec 14147->14148 14150 444124 14149->14150 14150->14147 14254 437180 CoSetProxyBlanket 14255 425713 14256 42571b 14255->14256 14257 42572b RtlExpandEnvironmentStrings 14256->14257 14258 42575c 14257->14258 14258->14258 14264 445260 14258->14264 14260 425a27 14261 425a11 GetLogicalDrives 14263 445260 LdrInitializeThunk 14261->14263 14262 425874 14262->14260 14262->14261 14262->14262 14263->14260 14265 445280 14264->14265 14266 44536e 14265->14266 14268 442080 LdrInitializeThunk 14265->14268 14266->14262 14268->14266 14269 436312 14271 436316 14269->14271 14270 43629a 14271->14270 14272 4363bb SysAllocString 14271->14272 14273 4364d0 14272->14273 14274 421710 14275 42171e 14274->14275 14278 421778 14274->14278 14280 421830 14275->14280 14277 4217ec 14277->14278 14279 41f9a0 LdrInitializeThunk 14277->14279 14279->14278 14281 421840 14280->14281 14281->14281 14282 445260 LdrInitializeThunk 14281->14282 14283 421971 14282->14283 14284 43ce90 14285 43ceb8 14284->14285 14288 43cf2e 14285->14288 14293 442080 LdrInitializeThunk 14285->14293 14286 43d066 14288->14286 14290 43cfc0 14288->14290 14292 442080 LdrInitializeThunk 14288->14292 14290->14286 14294 442080 LdrInitializeThunk 14290->14294 14292->14288 14293->14285 14294->14290 14295 440510 14296 440530 14295->14296 14297 44054e 14295->14297 14296->14297 14303 442080 LdrInitializeThunk 14296->14303 14299 4404b0 RtlAllocateHeap 14297->14299 14302 44063e 14297->14302 14300 44060d 14299->14300 14300->14302 14304 442080 LdrInitializeThunk 14300->14304 14303->14297 14304->14302 14151 430f54 14153 430f64 14151->14153 14152 43102b GetComputerNameExA 14154 4310af 14152->14154 14153->14152 14154->14154 14155 408a60 14157 408a6f 14155->14157 14156 408d05 ExitProcess 14157->14156 14158 408a84 GetCurrentProcessId GetCurrentThreadId 14157->14158 14165 408ce9 14157->14165 14159 408ac3 SHGetSpecialFolderPathW GetForegroundWindow 14158->14159 14160 408abd 14158->14160 14161 408b95 14159->14161 14160->14159 14161->14161 14166 4404b0 14161->14166 14163 408c27 14163->14165 14169 40d400 CoInitializeEx 14163->14169 14165->14156 14170 443770 14166->14170 14168 4404ba RtlAllocateHeap 14168->14163 14171 4437a0 14170->14171 14171->14168 14171->14171 14310 42f222 14311 42f280 14310->14311 14311->14311 14312 42f2e8 GetComputerNameExA 14311->14312 14313 40daa3 14314 40dad0 14313->14314 14317 43d0d0 14314->14317 14316 40dc55 14318 43d120 14317->14318 14318->14318 14319 43d529 CoCreateInstance 14318->14319 14320 43d585 SysAllocString 14319->14320 14321 43db6d 14319->14321 14324 43d62c 14320->14324 14322 43db7d GetVolumeInformationW 14321->14322 14331 43db9b 14322->14331 14325 43d634 CoSetProxyBlanket 14324->14325 14326 43db5c SysFreeString 14324->14326 14327 43db52 14325->14327 14328 43d654 SysAllocString 14325->14328 14326->14321 14327->14326 14330 43d740 14328->14330 14330->14330 14332 43d764 SysAllocString 14330->14332 14331->14316 14334 43d78a 14332->14334 14333 43db39 SysFreeString SysFreeString 14333->14327 14334->14333 14335 43db2f 14334->14335 14336 43d7ce VariantInit 14334->14336 14335->14333 14338 43d850 14336->14338 14337 43db1e VariantClear 14337->14335 14338->14337 14339 418ba2 14341 418c10 14339->14341 14340 418fb7 14341->14340 14342 445260 LdrInitializeThunk 14341->14342 14342->14341 14177 43b967 14179 43b97f 14177->14179 14178 43b996 GetUserDefaultUILanguage 14180 43b9e1 14178->14180 14179->14178 14181 434865 14184 414c20 14181->14184 14183 43486a CoSetProxyBlanket 14184->14183 14185 4404e2 14186 4404f0 14185->14186 14187 4404f2 14185->14187 14188 4404f7 RtlFreeHeap 14187->14188 14189 40e16e 14193 409b70 14189->14193 14191 40e17a CoUninitialize 14192 40e1b0 14191->14192 14194 409b84 14193->14194 14194->14191 14195 4180f0 14195->14195 14196 4180f8 14195->14196 14197 418468 CryptUnprotectData 14196->14197 14348 421b30 14360 4450f0 14348->14360 14350 42228c 14351 421b77 14351->14350 14352 4404b0 RtlAllocateHeap 14351->14352 14353 421bd2 14352->14353 14359 421be9 14353->14359 14364 442080 LdrInitializeThunk 14353->14364 14355 4404b0 RtlAllocateHeap 14355->14359 14356 421cb9 14356->14350 14366 442080 LdrInitializeThunk 14356->14366 14359->14355 14359->14356 14365 442080 LdrInitializeThunk 14359->14365 14361 445110 14360->14361 14362 445208 14361->14362 14367 442080 LdrInitializeThunk 14361->14367 14362->14351 14364->14353 14365->14359 14366->14356 14367->14362 14368 40d433 CoInitializeSecurity 14369 430030 14370 430080 14369->14370 14371 43014e 14370->14371 14373 442080 LdrInitializeThunk 14370->14373 14373->14371 14198 4425f2 14199 442602 14198->14199 14201 44261e 14198->14201 14199->14201 14202 442080 LdrInitializeThunk 14199->14202 14202->14201 14374 40e139 14379 437c10 14374->14379 14380 437c3e GetSystemMetrics GetSystemMetrics 14379->14380 14381 437c81 14380->14381 14208 433bfe 14210 433c36 SysAllocString 14208->14210 14211 433db8 14210->14211 14212 42fb7d 14213 42fb88 14212->14213 14213->14213 14214 42fc5a GetPhysicallyInstalledSystemMemory 14213->14214 14215 42fcb0 14214->14215 14215->14215 14216 40df7f 14218 40df8b 14216->14218 14219 40dfa4 14216->14219 14217 40dfee 14240 425560 14217->14240 14218->14219 14244 442080 LdrInitializeThunk 14218->14244 14219->14217 14245 442080 LdrInitializeThunk 14219->14245 14222 40e02e 14224 425da0 RtlExpandEnvironmentStrings RtlExpandEnvironmentStrings RtlAllocateHeap LdrInitializeThunk 14222->14224 14225 40e04e 14224->14225 14226 426010 RtlExpandEnvironmentStrings RtlAllocateHeap LdrInitializeThunk 14225->14226 14227 40e06e 14226->14227 14228 427fc0 RtlAllocateHeap RtlReAllocateHeap LdrInitializeThunk 14227->14228 14229 40e08e 14228->14229 14230 428750 RtlAllocateHeap LdrInitializeThunk 14229->14230 14231 40e097 14230->14231 14232 428b10 RtlAllocateHeap LdrInitializeThunk 14231->14232 14233 40e0a0 14232->14233 14234 42ba20 RtlExpandEnvironmentStrings RtlExpandEnvironmentStrings 14233->14234 14235 40e0a9 14234->14235 14236 42a7f0 RtlExpandEnvironmentStrings RtlExpandEnvironmentStrings LdrInitializeThunk 14235->14236 14237 40e0c9 14236->14237 14238 437a60 6 API calls 14237->14238 14239 40e0f2 14238->14239 14241 4255d0 14240->14241 14241->14241 14242 4255e6 RtlExpandEnvironmentStrings 14241->14242 14243 425660 14242->14243 14244->14219 14245->14217 14246 40ebff 14247 40ec7e 14246->14247 14248 40ec5f 14246->14248 14251 40ed2e 14247->14251 14252 442080 LdrInitializeThunk 14247->14252 14248->14247 14253 442080 LdrInitializeThunk 14248->14253 14252->14251 14253->14247 14382 442b3b 14383 442b45 14382->14383 14385 442c0e 14383->14385 14386 442080 LdrInitializeThunk 14383->14386 14386->14385

                                                                                                                                                                                                                                                          Executed Functions

                                                                                                                                                                                                                                                          Function 0043D0D0 Relevance: 32.5, APIs: 11, Strings: 7, Instructions: 957memorycomCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 0 43d0d0-43d112 1 43d120-43d18e 0->1 1->1 2 43d190-43d1b6 1->2 3 43d1c0-43d1f8 2->3 3->3 4 43d1fa-43d25f 3->4 5 43d260-43d289 4->5 5->5 6 43d28b-43d2a8 5->6 8 43d2ae-43d2b8 6->8 9 43d3bd-43d3d5 6->9 11 43d2c0-43d31d 8->11 10 43d3e0-43d3ff 9->10 10->10 12 43d401-43d47b 10->12 11->11 13 43d31f-43d349 11->13 14 43d480-43d4c0 12->14 15 43d350-43d3af 13->15 14->14 16 43d4c2-43d51f 14->16 15->15 17 43d3b1-43d3b5 15->17 18 43d520-43d527 16->18 17->9 18->18 19 43d529-43d57f CoCreateInstance 18->19 20 43d585-43d5d5 19->20 21 43db6d-43db99 call 443b60 GetVolumeInformationW 19->21 23 43d5e0-43d605 20->23 26 43dba2-43dba4 21->26 27 43db9b-43db9e 21->27 23->23 25 43d607-43d62e SysAllocString 23->25 32 43d634-43d64e CoSetProxyBlanket 25->32 33 43db5c-43db69 SysFreeString 25->33 28 43dbc7-43dbd2 26->28 27->26 30 43dbd4-43dbdb 28->30 31 43dbde-43dc0b 28->31 30->31 34 43dc10-43dc6a 31->34 35 43db52-43db58 32->35 36 43d654-43d67f 32->36 33->21 34->34 37 43dc6c-43dc97 34->37 35->33 38 43d680-43d6a5 36->38 39 43dca0-43dcdc 37->39 38->38 40 43d6a7-43d732 SysAllocString 38->40 39->39 42 43dcde-43dd02 call 41dce0 39->42 41 43d740-43d762 40->41 41->41 43 43d764-43d78c SysAllocString 41->43 46 43dd10-43dd17 42->46 49 43d792-43d7b4 43->49 50 43db39-43db4e SysFreeString * 2 43->50 46->46 48 43dd19-43dd2c 46->48 51 43dd32-43dd45 call 408430 48->51 52 43dbb0-43dbc1 48->52 57 43d7ba-43d7bd 49->57 58 43db2f-43db35 49->58 50->35 51->52 52->28 55 43dd4a-43dd51 52->55 57->58 59 43d7c3-43d7c8 57->59 58->50 59->58 60 43d7ce-43d843 VariantInit 59->60 61 43d850-43d8d3 60->61 61->61 62 43d8d9-43d8f2 61->62 63 43d8f6-43d8fb 62->63 64 43d901-43d90a 63->64 65 43db1e-43db2b VariantClear 63->65 64->65 66 43d910-43d91f 64->66 65->58 67 43d921-43d926 66->67 68 43d95d 66->68 69 43d93c-43d940 67->69 70 43d95f-43d97d call 408270 68->70 71 43d942-43d94b 69->71 72 43d930 69->72 79 43d983-43d997 70->79 80 43dac9-43dada 70->80 75 43d952-43d956 71->75 76 43d94d-43d950 71->76 74 43d931-43d93a 72->74 74->69 74->70 75->74 78 43d958-43d95b 75->78 76->74 78->74 79->80 83 43d99d-43d9a3 79->83 81 43dae1-43daf2 80->81 82 43dadc 80->82 84 43daf4 81->84 85 43daf9-43db1b call 4082a0 call 408280 81->85 82->81 86 43d9b0-43d9ba 83->86 84->85 85->65 88 43d9d0-43d9d6 86->88 89 43d9bc-43d9c1 86->89 91 43d9f5-43da07 88->91 92 43d9d8-43d9db 88->92 90 43da60-43da76 89->90 98 43da79-43da7f 90->98 95 43da8b-43da94 91->95 96 43da0d-43da10 91->96 92->91 94 43d9dd-43d9f3 92->94 94->90 102 43da96-43da98 95->102 103 43da9a-43da9d 95->103 96->95 99 43da12-43da5f 96->99 98->80 101 43da81-43da83 98->101 99->90 101->86 104 43da89 101->104 102->98 105 43dac5-43dac7 103->105 106 43da9f-43dac3 103->106 104->80 105->90 106->90
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • CoCreateInstance.OLE32(80838290,00000000,00000001,?,00000000), ref: 0043D572
                                                                                                                                                                                                                                                          • SysAllocString.OLEAUT32 ref: 0043D608
                                                                                                                                                                                                                                                          • CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0043D646
                                                                                                                                                                                                                                                          • SysAllocString.OLEAUT32 ref: 0043D6A8
                                                                                                                                                                                                                                                          • SysAllocString.OLEAUT32 ref: 0043D765
                                                                                                                                                                                                                                                          • VariantInit.OLEAUT32(?), ref: 0043D7D6
                                                                                                                                                                                                                                                          • SysFreeString.OLEAUT32(00000000), ref: 0043DB5D
                                                                                                                                                                                                                                                          • GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 0043DB95
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: String$Alloc$BlanketCreateFreeInformationInitInstanceProxyVariantVolume
                                                                                                                                                                                                                                                          • String ID: fF$CfF$[B$[J$tu$yv${pqv
                                                                                                                                                                                                                                                          • API String ID: 505850577-1972840126
                                                                                                                                                                                                                                                          • Opcode ID: 3ddc2ead7565efc33bb403abcee38b0898e8d98e79c6cb4a9a4b1927beae507d
                                                                                                                                                                                                                                                          • Instruction ID: dd13a90e2492ac68040bcad17eea3e7c9d23fbfdc89757e028f71a1dea91b727
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3ddc2ead7565efc33bb403abcee38b0898e8d98e79c6cb4a9a4b1927beae507d
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 94621372A183108FE314CF68D88576BBBE1EFD5314F198A2DE4D58B390D7799809CB86
                                                                                                                                                                                                                                                          Function 0040E16E Relevance: 10.8, APIs: 1, Strings: 6, Instructions: 345COMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 111 40e16e-40e1af call 409b70 CoUninitialize 114 40e1b0-40e216 111->114 114->114 115 40e218-40e242 114->115 116 40e250-40e298 115->116 116->116 117 40e29a-40e303 116->117 118 40e310-40e343 117->118 118->118 119 40e345-40e356 118->119 120 40e358-40e366 119->120 121 40e37b-40e383 119->121 124 40e370-40e379 120->124 122 40e385-40e386 121->122 123 40e39b-40e3a5 121->123 125 40e390-40e399 122->125 126 40e3a7-40e3ab 123->126 127 40e3bb-40e3c3 123->127 124->121 124->124 125->123 125->125 128 40e3b0-40e3b9 126->128 129 40e3c5-40e3c6 127->129 130 40e3db-40e3e5 127->130 128->127 128->128 131 40e3d0-40e3d9 129->131 132 40e3e7-40e3eb 130->132 133 40e3fb-40e407 130->133 131->130 131->131 134 40e3f0-40e3f9 132->134 135 40e421-40e54e 133->135 136 40e409-40e40b 133->136 134->133 134->134 137 40e550-40e577 135->137 138 40e410-40e41d 136->138 137->137 139 40e579-40e5af 137->139 138->138 140 40e41f 138->140 141 40e5b0-40e60a 139->141 140->135 141->141 142 40e60c-40e636 call 40c080 141->142 144 40e63b-40e655 142->144
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: Uninitialize
                                                                                                                                                                                                                                                          • String ID: RYZ[$UGC9$Zb$c[i!$pancakedipyps.click$yD
                                                                                                                                                                                                                                                          • API String ID: 3861434553-3553024370
                                                                                                                                                                                                                                                          • Opcode ID: 9bb15100d4bb6a15a77dc5872525b3ecedab199ceaceba36afab7cc08321f92a
                                                                                                                                                                                                                                                          • Instruction ID: 966cdb19ca8ac249a37a340b6d4c56d028db331cb6ce3dd003334f0be9ec8841
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 9bb15100d4bb6a15a77dc5872525b3ecedab199ceaceba36afab7cc08321f92a
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C3C1FF7150C3D08BDB348F2598687ABBBE1AFD2304F084D6DD8D95B286D678450A8B96
                                                                                                                                                                                                                                                          Function 00408A60 Relevance: 7.7, APIs: 5, Instructions: 216threadCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 267 408a60-408a71 call 4416b0 270 408d05-408d07 ExitProcess 267->270 271 408a77-408a7e call 43a2c0 267->271 274 408d00 call 442000 271->274 275 408a84-408abb GetCurrentProcessId GetCurrentThreadId 271->275 274->270 277 408ac3-408b93 SHGetSpecialFolderPathW GetForegroundWindow 275->277 278 408abd-408ac1 275->278 279 408b95-408bb7 277->279 280 408bdc-408bef 277->280 278->277 282 408bb9-408bbb 279->282 283 408bbd-408bda 279->283 281 408bf0-408c1c 280->281 281->281 284 408c1e-408c4a call 4404b0 281->284 282->283 283->280 287 408c50-408c8b 284->287 288 408cc4-408ce2 call 40a170 287->288 289 408c8d-408cc2 287->289 292 408ce4 call 40d400 288->292 293 408cee-408cf5 288->293 289->287 296 408ce9 call 40c050 292->296 293->274 295 408cf7-408cfd call 408280 293->295 295->274 296->293
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • GetCurrentProcessId.KERNEL32 ref: 00408A84
                                                                                                                                                                                                                                                          • GetCurrentThreadId.KERNEL32 ref: 00408A8E
                                                                                                                                                                                                                                                          • SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 00408B76
                                                                                                                                                                                                                                                          • GetForegroundWindow.USER32 ref: 00408B8B
                                                                                                                                                                                                                                                          • ExitProcess.KERNEL32 ref: 00408D07
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 4063528623-0
                                                                                                                                                                                                                                                          • Opcode ID: ba99a32a84df6074fc1a326d170a01607909a1aa19cc5cd935f515b9d2d4cca7
                                                                                                                                                                                                                                                          • Instruction ID: 695b1043c619777a8863990e744e8888075fa37916c6100b3e536846f602c71f
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ba99a32a84df6074fc1a326d170a01607909a1aa19cc5cd935f515b9d2d4cca7
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E3616873B143140BD318AE799C1635AB6D39BC5314F0F863EA995EB7D1ED7888068389
                                                                                                                                                                                                                                                          Function 0042F716 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 366COMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 300 42f716-42f73a 301 42f740-42f754 300->301 301->301 302 42f756-42f75d 301->302 303 42f77b-42fbcb 302->303 304 42f75f-42f763 302->304 307 42fbd0-42fbe4 303->307 305 42f770-42f779 304->305 305->303 305->305 307->307 308 42fbe6-42fbed 307->308 309 42fc0b-42fc17 308->309 310 42fbef-42fbf3 308->310 312 42fc31-42fc55 call 443b60 309->312 313 42fc19-42fc1b 309->313 311 42fc00-42fc09 310->311 311->309 311->311 317 42fc5a-42fcae GetPhysicallyInstalledSystemMemory 312->317 314 42fc20-42fc2d 313->314 314->314 316 42fc2f 314->316 316->312 318 42fcb0-42fcea 317->318 318->318 319 42fcec-42fd2f call 41dce0 318->319 322 42fd30-42fd75 319->322 322->322 323 42fd77-42fd7e 322->323 324 42fd80-42fd88 323->324 325 42fd9d 323->325 326 42fd90-42fd99 324->326 327 42fda1-42fda9 325->327 326->326 328 42fd9b 326->328 329 42fdbb-42fdc8 327->329 330 42fdab-42fdaf 327->330 328->327 332 42fdca-42fdd1 329->332 333 42fdeb-42fe57 329->333 331 42fdb0-42fdb9 330->331 331->329 331->331 334 42fde0-42fde9 332->334 335 42fe60-42fe85 333->335 334->333 334->334 335->335 336 42fe87-42fe8e 335->336 337 42fe90-42fe94 336->337 338 42feab-42feb8 336->338 339 42fea0-42fea9 337->339 340 42feba-42fec1 338->340 341 42fedb-42ff7a 338->341 339->338 339->339 342 42fed0-42fed9 340->342 342->341 342->342
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042FC65
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: InstalledMemoryPhysicallySystem
                                                                                                                                                                                                                                                          • String ID: 5$Tx+$bC
                                                                                                                                                                                                                                                          • API String ID: 3960555810-2958649183
                                                                                                                                                                                                                                                          • Opcode ID: bd69bc838739ae90d4b0a58172e55ce76a86b20f4efd0bead3c1e9785a5287de
                                                                                                                                                                                                                                                          • Instruction ID: 57781aab13a08c1a066b8e14d20b5adcd793598ba32206fb76d556f76c65c1e4
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bd69bc838739ae90d4b0a58172e55ce76a86b20f4efd0bead3c1e9785a5287de
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 66B1C17050C3918AE7358F2990643ABFFE0AF93304F98496ED5C987392D7794409CB56
                                                                                                                                                                                                                                                          Function 0042FB7D Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 327COMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 343 42fb7d-42fbcb call 437610 call 408280 349 42fbd0-42fbe4 343->349 349->349 350 42fbe6-42fbed 349->350 351 42fc0b-42fc17 350->351 352 42fbef-42fbf3 350->352 354 42fc31-42fcae call 443b60 GetPhysicallyInstalledSystemMemory 351->354 355 42fc19-42fc1b 351->355 353 42fc00-42fc09 352->353 353->351 353->353 360 42fcb0-42fcea 354->360 356 42fc20-42fc2d 355->356 356->356 358 42fc2f 356->358 358->354 360->360 361 42fcec-42fd2f call 41dce0 360->361 364 42fd30-42fd75 361->364 364->364 365 42fd77-42fd7e 364->365 366 42fd80-42fd88 365->366 367 42fd9d 365->367 368 42fd90-42fd99 366->368 369 42fda1-42fda9 367->369 368->368 370 42fd9b 368->370 371 42fdbb-42fdc8 369->371 372 42fdab-42fdaf 369->372 370->369 374 42fdca-42fdd1 371->374 375 42fdeb-42fe57 371->375 373 42fdb0-42fdb9 372->373 373->371 373->373 376 42fde0-42fde9 374->376 377 42fe60-42fe85 375->377 376->375 376->376 377->377 378 42fe87-42fe8e 377->378 379 42fe90-42fe94 378->379 380 42feab-42feb8 378->380 381 42fea0-42fea9 379->381 382 42feba-42fec1 380->382 383 42fedb-42ff7a 380->383 381->380 381->381 384 42fed0-42fed9 382->384 384->383 384->384
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • GetPhysicallyInstalledSystemMemory.KERNELBASE(?), ref: 0042FC65
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: InstalledMemoryPhysicallySystem
                                                                                                                                                                                                                                                          • String ID: 5$Tx+$bC
                                                                                                                                                                                                                                                          • API String ID: 3960555810-2958649183
                                                                                                                                                                                                                                                          • Opcode ID: b019f8faa7078be6aa673cad719c14887d56416cdb44293ea95d0146935d494c
                                                                                                                                                                                                                                                          • Instruction ID: c6dbd191573f8eaa778921652fb4887c0da57f4868ba9d7cab245032b22be67a
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b019f8faa7078be6aa673cad719c14887d56416cdb44293ea95d0146935d494c
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D0A1C17050C3918AE739CF2994603EBBFE0AF96304F58897ED5C987392D7794409CB56
                                                                                                                                                                                                                                                          Function 0040C080 Relevance: 6.4, Strings: 5, Instructions: 104COMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 385 40c080-40c2df 386 40c2e0-40c315 385->386 386->386 387 40c317-40c323 386->387 388 40c326-40c343 387->388
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: 50$DM_e$FwPq$Js$'!
                                                                                                                                                                                                                                                          • API String ID: 0-1711485358
                                                                                                                                                                                                                                                          • Opcode ID: c4c1f8e28e835abe653d42ead9130a3bdb40cd1f355abcf11e9a7fb6b3c4c5b3
                                                                                                                                                                                                                                                          • Instruction ID: a29f9b67a002a0f45ebf0d2c5d73cf8b9506a9b5be0e3ba76b97c1ae1caaee17
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c4c1f8e28e835abe653d42ead9130a3bdb40cd1f355abcf11e9a7fb6b3c4c5b3
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C751DAB45493808FE334CF21C991B8BBBB1BBA1304F609A0CE6D95B654CB759446CF97
                                                                                                                                                                                                                                                          Function 00425713 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 346COMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 389 425713-425719 390 425722 389->390 391 42571b-425720 389->391 392 425725-425755 call 408270 RtlExpandEnvironmentStrings 390->392 391->392 395 425764-42576d 392->395 396 42575c 392->396 397 425776 395->397 398 42576f-425774 395->398 396->395 399 42577d-4257d2 call 408270 397->399 398->399 402 4257e0-425802 399->402 402->402 403 425804-42580c 402->403 404 425831-425845 403->404 405 42580e-425813 403->405 407 425861-42586f call 445260 404->407 408 425847-42584b 404->408 406 425820-42582f 405->406 406->404 406->406 411 425874-42587c 407->411 409 425850-42585f 408->409 409->407 409->409 412 425883-42588d 411->412 413 425a50 411->413 414 425896-42589f 411->414 412->414 418 425a56-425a7f 413->418 415 4258a1-4258a6 414->415 416 4258a8 414->416 417 4258af-425979 call 408270 415->417 416->417 423 425980-4259b6 417->423 420 425a80-425a92 418->420 420->420 422 425a94-425b2a 420->422 424 425b30-425b5f 422->424 423->423 425 4259b8-4259c3 423->425 424->424 426 425b61-425b84 call 4219a0 424->426 427 4259e1-4259ee 425->427 428 4259c5-4259ca 425->428 436 425b8c-425b92 call 408280 426->436 431 4259f0-4259f4 427->431 432 425a11-425a31 GetLogicalDrives call 445260 427->432 430 4259d0-4259df 428->430 430->427 430->430 434 425a00-425a0f 431->434 432->418 432->436 439 425bc2-425bc8 call 408280 432->439 440 425ba1-425ba9 call 408280 432->440 441 425d95 432->441 442 425a4a 432->442 443 425b9b 432->443 444 425a38-425a42 432->444 445 425bb9-425bbf call 408280 432->445 446 425d8f 432->446 447 425bac-425bb8 432->447 434->432 434->434 436->443 439->446 440->447 441->441 442->413 443->440 444->442 445->439 446->441
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 00425743
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: EnvironmentExpandStrings
                                                                                                                                                                                                                                                          • String ID: 67
                                                                                                                                                                                                                                                          • API String ID: 237503144-1886922373
                                                                                                                                                                                                                                                          • Opcode ID: e3d5ee6a10ef3cb590ca084e24df21bec85322a84b333c3760c72d733834ca72
                                                                                                                                                                                                                                                          • Instruction ID: 69054aec17b57e4c885244c43c85c7a2a523591f4f2f134b8c84ae4bc1ca1ac0
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e3d5ee6a10ef3cb590ca084e24df21bec85322a84b333c3760c72d733834ca72
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6EB1A9B4508710CBD7109F54E88176BBBE0FF86708F44496EE9849B391E7B9C949CB8B
                                                                                                                                                                                                                                                          Function 00437C10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 181COMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 455 437c10-437cf5 GetSystemMetrics * 2 461 437cfc-43812e 455->461
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: MetricsSystem
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 4116985748-3916222277
                                                                                                                                                                                                                                                          • Opcode ID: 12748a352a6113057c12441240e5b0ee108c97012b660969c1fdd4a02f1b159c
                                                                                                                                                                                                                                                          • Instruction ID: 45907af0f9aaa3a0b9b12b1f6695193350465b50a920b4478e3ecda7c38bd9fb
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 12748a352a6113057c12441240e5b0ee108c97012b660969c1fdd4a02f1b159c
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 23C15BB05093808BE7B0DF64D99979BFBF1BB85308F10992EE5984B354C7B89449CF4A
                                                                                                                                                                                                                                                          Function 00418BA2 Relevance: 5.4, Strings: 4, Instructions: 367COMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 464 418ba2-418c02 465 418c10-418c4c 464->465 465->465 466 418c4e-418c6e call 401dd0 465->466 469 418da0-418da6 call 408280 466->469 470 419040-419049 call 401f60 466->470 471 418d83-418d9c 466->471 472 418fa3-418fb0 466->472 473 418fe6-419010 call 41bdd0 466->473 474 418da9-418dba 466->474 475 419030 466->475 476 419050-419056 call 401f60 466->476 477 418c75-418ccb 466->477 478 418dd4-418de9 call 401e00 466->478 479 418fb7-418fc5 466->479 480 419018-419021 call 408280 466->480 481 41903a 466->481 469->474 470->476 490 418dbd-418dcd call 401df0 471->490 472->469 472->470 472->473 472->474 472->475 472->476 472->479 472->480 482 41905f-4195af 472->482 473->480 474->490 475->481 476->482 487 418cd0-418cf4 477->487 505 418e50 478->505 506 418deb-418df0 478->506 483 418fe1 479->483 484 418fc7-418fcf 479->484 480->475 481->470 483->473 493 418fd0-418fdf 484->493 487->487 496 418cf6-418d79 call 41bdd0 487->496 490->469 490->470 490->472 490->473 490->474 490->475 490->476 490->478 490->479 490->480 490->481 490->482 493->483 493->493 496->471 508 418e52-418e55 505->508 507 418e09-418e0b 506->507 510 418e00 507->510 511 418e0d-418e1e 507->511 512 418e60 508->512 513 418e57-418e5c 508->513 514 418e01-418e07 510->514 511->510 515 418e20-418e38 511->515 516 418e67-418eb2 call 408270 call 40aff0 512->516 513->516 514->507 514->508 515->510 517 418e3a-418e46 515->517 523 418ec0-418ec2 516->523 524 418eb4-418eb9 516->524 517->514 519 418e48-418e4b 517->519 519->514 525 418ec9-418ee4 call 408270 523->525 524->525 528 418f01-418f2f 525->528 529 418ee6-418eeb 525->529 531 418f30-418f4a 528->531 530 418ef0-418eff 529->530 530->528 530->530 531->531 532 418f4c-418f60 531->532 533 418f81-418f8f call 445260 532->533 534 418f62-418f67 532->534 537 418f94-418f9c 533->537 535 418f70-418f7f 534->535 535->533 535->535 537->469 537->470 537->472 537->473 537->474 537->475 537->476 537->479 537->480 537->482
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: PWPQ$bd\,$fnga$oQ
                                                                                                                                                                                                                                                          • API String ID: 0-3706350231
                                                                                                                                                                                                                                                          • Opcode ID: fe0c42c07420c9bbc5d61f49a80fd29d9882301a9105f023342265155b572c4c
                                                                                                                                                                                                                                                          • Instruction ID: e34152e6636813154928bb160b9fd2834c9c91dba41fdab838839377217cf8bd
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: fe0c42c07420c9bbc5d61f49a80fd29d9882301a9105f023342265155b572c4c
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1CC126766083408FD7258F24C8557AB77E6EFC6314F08892EE8998B391EF388841C787
                                                                                                                                                                                                                                                          Function 00430F54 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 538 430f54-430f62 539 430f64-430f6b 538->539 540 430f7b-430fef call 443b60 538->540 541 430f70-430f79 539->541 546 430ff0-43100a 540->546 541->540 541->541 546->546 547 43100c-431016 546->547 548 43102b-4310a8 GetComputerNameExA 547->548 549 431018-43101f 547->549 551 4310af 548->551 550 431020-431029 549->550 550->548 550->550 551->551
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?), ref: 00430F85
                                                                                                                                                                                                                                                          • GetComputerNameExA.KERNELBASE(00000006,?,00000100), ref: 0043104A
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: ComputerFreeLibraryName
                                                                                                                                                                                                                                                          • String ID: Mw
                                                                                                                                                                                                                                                          • API String ID: 2904949787-2910736759
                                                                                                                                                                                                                                                          • Opcode ID: d64d061adfdbf120dee82a0fc1018915ebc31be6462cf1f122b0efd75b845ce0
                                                                                                                                                                                                                                                          • Instruction ID: 7b7113e42e32beabe8c4c016577568230ad12c23f9774a4b5fe118adb1295c8a
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d64d061adfdbf120dee82a0fc1018915ebc31be6462cf1f122b0efd75b845ce0
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9531F33691C3D08BE3348F359C553EBBBE2ABC6314F19866DC8D857285DB7A1805CB86
                                                                                                                                                                                                                                                          Function 00430F4E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 552 430f4e-430fef call 443b60 557 430ff0-43100a 552->557 557->557 558 43100c-431016 557->558 559 43102b-4310a8 GetComputerNameExA 558->559 560 431018-43101f 558->560 562 4310af 559->562 561 431020-431029 560->561 561->559 561->561 562->562
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?), ref: 00430F85
                                                                                                                                                                                                                                                          • GetComputerNameExA.KERNELBASE(00000006,?,00000100), ref: 0043104A
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: ComputerFreeLibraryName
                                                                                                                                                                                                                                                          • String ID: Mw
                                                                                                                                                                                                                                                          • API String ID: 2904949787-2910736759
                                                                                                                                                                                                                                                          • Opcode ID: d43ff3280345835f4c21c516bd395dd340a58cd7044fd3e67ca854e034ba4060
                                                                                                                                                                                                                                                          • Instruction ID: fb4d1f38de1a85f36896b77157d4be4448694684cc70b9096da98958b1763f09
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d43ff3280345835f4c21c516bd395dd340a58cd7044fd3e67ca854e034ba4060
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D931F23695C3908BE3348F359C953DBBBE2ABC6314F19862DC8D817284DB7A1805CB86
                                                                                                                                                                                                                                                          Function 00415D89 Relevance: 1.6, APIs: 1, Instructions: 141COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                          • Opcode ID: dbee84ecd3790633f2c83826065bd30b531f242f0a5518141b0bd449406d4866
                                                                                                                                                                                                                                                          • Instruction ID: fe71d1bcebcc68b075db47888e1e2cba677fa4d5c187ad294acff22be9a80e62
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: dbee84ecd3790633f2c83826065bd30b531f242f0a5518141b0bd449406d4866
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1B51B9B16086428FC714CF58C4917ABF7E2ABD5304F18892EE4EA87342E739DD45CB86
                                                                                                                                                                                                                                                          Function 00430F03 Relevance: 1.6, APIs: 1, Instructions: 79COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • GetComputerNameExA.KERNELBASE(00000006,?,00000100), ref: 0043104A
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: ComputerName
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 3545744682-0
                                                                                                                                                                                                                                                          • Opcode ID: b124762bb82201bc91150ff6a1fbec5ae2415c41406e4d3524ac183859c93793
                                                                                                                                                                                                                                                          • Instruction ID: 4d6f8d4a3a0c9291bd82fbf102df9c74bb0e146b1c020dae9dd1e6f681f2a276
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b124762bb82201bc91150ff6a1fbec5ae2415c41406e4d3524ac183859c93793
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D921E1369583A04BE3348F359C913DBBBE2ABC6314F09872DC8D817285DB7A1805CBC6
                                                                                                                                                                                                                                                          Function 00444C20 Relevance: 1.6, Strings: 1, Instructions: 312COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: InitializeThunk
                                                                                                                                                                                                                                                          • String ID: Y\]R
                                                                                                                                                                                                                                                          • API String ID: 2994545307-2023185185
                                                                                                                                                                                                                                                          • Opcode ID: e368f69b4051d92f4704c4a144e7348ede97506515b2c153191350598cb49a47
                                                                                                                                                                                                                                                          • Instruction ID: 32cb53c941d059e59dbce30d87d00b37379897002de2ab33e1c58f8979392959
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: e368f69b4051d92f4704c4a144e7348ede97506515b2c153191350598cb49a47
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6E910371A087118BE314CF29D89076BF7E2FBC5314F18862DE89597391DB79DC0A8786
                                                                                                                                                                                                                                                          Function 00442080 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • LdrInitializeThunk.NTDLL(0044523A,?,00000018,?,?,00000018,?,?,?), ref: 004420AE
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: InitializeThunk
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 2994545307-0
                                                                                                                                                                                                                                                          • Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
                                                                                                                                                                                                                                                          • Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82
                                                                                                                                                                                                                                                          Function 004442E0 Relevance: .3, Instructions: 321COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: InitializeThunk
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 2994545307-0
                                                                                                                                                                                                                                                          • Opcode ID: dacedb78e00f7b3ea06162b8a930dfcecaa1b39c86591f60bbd6e03e633e71ac
                                                                                                                                                                                                                                                          • Instruction ID: 5aabee4b8b26e2ec9a193049fa608abe716db33e51fa934c25155f6b19f8c581
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: dacedb78e00f7b3ea06162b8a930dfcecaa1b39c86591f60bbd6e03e633e71ac
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AC9115316083018BEB14DF29D86072FB7E2FFC9724F15892DE9C597390D73898158B8A
                                                                                                                                                                                                                                                          Function 00441B50 Relevance: .1, Instructions: 110COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                          • Opcode ID: 4c5a90b9fb371d52f131ad3a9995dc80354c686060061162c2bdec51d185e8da
                                                                                                                                                                                                                                                          • Instruction ID: 01036c0abe53894f00a23a0b33865d1644de07ddd8768e0b6d49d0c725de61cd
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 4c5a90b9fb371d52f131ad3a9995dc80354c686060061162c2bdec51d185e8da
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0F4100BA4583028BD314CF51D89035BFAE3ABC5308F19CA2DE4C95B344DAB9C5098B96
                                                                                                                                                                                                                                                          Function 00441816 Relevance: .1, Instructions: 58COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                          • Opcode ID: 136ff0709e28839b269720e4fb839b7b46befae130c92130e2f97ddf8959a9d5
                                                                                                                                                                                                                                                          • Instruction ID: d294dc39abdefed7299eeb113bd94dd65164e84cb7974bfe8d228d73c8c27ee3
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 136ff0709e28839b269720e4fb839b7b46befae130c92130e2f97ddf8959a9d5
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 1911D0792593018BD308CF55DC9136BFBE3ABC6348F19C92DE18557355CAB8C106CB5A
                                                                                                                                                                                                                                                          Function 00433BFE Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 155memoryCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule

                                                                                                                                                                                                                                                          Control-flow Graph

                                                                                                                                                                                                                                                          • Executed
                                                                                                                                                                                                                                                          • Not Executed
                                                                                                                                                                                                                                                          control_flow_graph 632 433bfe-433c31 633 433c36-433c40 632->633 633->633 634 433c42-433c44 633->634 635 433c4a-433c4d 634->635 636 433c74-433db3 SysAllocString 635->636 637 433c4f-433c72 635->637 638 433db8-433dc2 636->638 637->635 638->638 639 433dc4 638->639 640 433dc6-433dc9 639->640 641 433de0-433e25 640->641 642 433dcb-433dde 640->642 644 433e2f-433e46 641->644 642->640
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: AllocString
                                                                                                                                                                                                                                                          • String ID: 0
                                                                                                                                                                                                                                                          • API String ID: 2525500382-4108050209
                                                                                                                                                                                                                                                          • Opcode ID: 5fd0e131bc77fa0b3fe7e8fe3de61800b8561d21a001358fa41a87ba010dec1e
                                                                                                                                                                                                                                                          • Instruction ID: c4235f0317d75f70fb27431be8bbc1b540243aae613e0231c981246c555c14ba
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5fd0e131bc77fa0b3fe7e8fe3de61800b8561d21a001358fa41a87ba010dec1e
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A881D810008FC3AED362CB3C8548345BF917B6B224F48878DD1E94BBD6C3A5A569C7A6
                                                                                                                                                                                                                                                          Function 004423C5 Relevance: 3.0, APIs: 2, Instructions: 26COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • GetForegroundWindow.USER32 ref: 004423C5
                                                                                                                                                                                                                                                          • GetForegroundWindow.USER32 ref: 004423E0
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: ForegroundWindow
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 2020703349-0
                                                                                                                                                                                                                                                          • Opcode ID: ea1af17a4c87661e7e22aa3b412247517447923eaeb0832990aa116f906f78b1
                                                                                                                                                                                                                                                          • Instruction ID: 3f5cde6939bccaa2b971e6e0c262a6c41a2af89a1d69f81b939c4d59ebd80ce7
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ea1af17a4c87661e7e22aa3b412247517447923eaeb0832990aa116f906f78b1
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D3D0A7BDD114104BB2559720BC0E45F36119B9B20A304443CE4070121BEA35118E868E
                                                                                                                                                                                                                                                          Function 00436312 Relevance: 1.7, APIs: 1, Instructions: 163memoryCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: AllocString
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 2525500382-0
                                                                                                                                                                                                                                                          • Opcode ID: ef8483e8ab778255dd258931c3d82cf31cc5b03f09e4434ba3215fbb1080e3d0
                                                                                                                                                                                                                                                          • Instruction ID: 95046018421402d0801aebd9565f509305716e141edef8233f74c498256fed45
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ef8483e8ab778255dd258931c3d82cf31cc5b03f09e4434ba3215fbb1080e3d0
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8F811A20108FC2CED332867C8948747BFD15B27228F484B9DD5E64BBD2D2AAB509C766
                                                                                                                                                                                                                                                          Function 0042F222 Relevance: 1.6, APIs: 1, Instructions: 69COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • GetComputerNameExA.KERNELBASE(00000005,D3BAB492,00000100), ref: 0042F301
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: ComputerName
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 3545744682-0
                                                                                                                                                                                                                                                          • Opcode ID: 5f99d4ff4f8377a95cea722d27edd5ab8b31f14781de5b973d5a456a3fa85f19
                                                                                                                                                                                                                                                          • Instruction ID: 2bea6ffdc9a5f01b0fb38135ff7c329ec52023607b2de6582bc56e9ec8f1d5ec
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5f99d4ff4f8377a95cea722d27edd5ab8b31f14781de5b973d5a456a3fa85f19
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5A218E3460D3D28BD774CF25D4987EBB7E0AB86304F54896DC4D987281CA75580ACB96
                                                                                                                                                                                                                                                          Function 0043B967 Relevance: 1.6, APIs: 1, Instructions: 67COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • GetUserDefaultUILanguage.KERNELBASE ref: 0043B996
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: DefaultLanguageUser
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 95929093-0
                                                                                                                                                                                                                                                          • Opcode ID: 98e9cfe35c1bf7e059ea3f603ca1750e6c53937badd962860f9777bb0233e5b3
                                                                                                                                                                                                                                                          • Instruction ID: 791500818c7a1469a8ddc9d1224b017d77911d2958c513979461ec400309f230
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 98e9cfe35c1bf7e059ea3f603ca1750e6c53937badd962860f9777bb0233e5b3
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4B219F71A046418FD714CF38C994B99BBF1AB5A310F0982D9D1A5DB3E2D7388D408F51
                                                                                                                                                                                                                                                          Function 00442020 Relevance: 1.5, APIs: 1, Instructions: 30memoryCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • RtlReAllocateHeap.NTDLL(?,00000000,?,00000000,?,?,0040BC80,00000000,00000000), ref: 00442052
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: AllocateHeap
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 1279760036-0
                                                                                                                                                                                                                                                          • Opcode ID: ea8428d80ce760913c6091ce044fd24d24df86904107ae5a33981043699a0a50
                                                                                                                                                                                                                                                          • Instruction ID: ce4dc6f8cea40f70218e043c946db7baefed7d7f927e290f9bf4e18e7a102a01
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ea8428d80ce760913c6091ce044fd24d24df86904107ae5a33981043699a0a50
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 95E02B72514210ABF2101F387C05B1736749FC2715F054436F601A3111D739E811C19E
                                                                                                                                                                                                                                                          Function 00437180 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: BlanketProxy
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 3890896728-0
                                                                                                                                                                                                                                                          • Opcode ID: 1eee05ed824ab0fad7e0fec43f832c4afae3966b95aa27efb02f9f36988d2f71
                                                                                                                                                                                                                                                          • Instruction ID: 81660e69c17f0543e92a0099c1eb05d4904c421e706bb06363d2a5bfa495106c
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1eee05ed824ab0fad7e0fec43f832c4afae3966b95aa27efb02f9f36988d2f71
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B9F0B7742497028FD355DF68C5A471BBBE0EF49304F01882CE5A68B290CBB5A948CF82
                                                                                                                                                                                                                                                          Function 00434865 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: BlanketProxy
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 3890896728-0
                                                                                                                                                                                                                                                          • Opcode ID: 53b3cb3652385e22ea377a8ab379108a4fc6dc91706275fd2e50ee136dcc3ceb
                                                                                                                                                                                                                                                          • Instruction ID: d7c258c8275f3fac7a4ea29dfb35da0c5007ac1f08ebe8bc9e26289c7763600b
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 53b3cb3652385e22ea377a8ab379108a4fc6dc91706275fd2e50ee136dcc3ceb
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C5F0A5B02087028FE310DF25C5A974FBBE5BB81348F11890DE5A54B291C7FA96898FC6
                                                                                                                                                                                                                                                          Function 0040D400 Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • CoInitializeEx.COMBASE(00000000,00000002), ref: 0040D413
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: Initialize
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 2538663250-0
                                                                                                                                                                                                                                                          • Opcode ID: b103da860b07b6caeef7231849386c8b9813f2fcc2fc8537c1924e67a92246bd
                                                                                                                                                                                                                                                          • Instruction ID: 5b8c1c1c38bc235c753b9088e917c06d101502a7d4806eff28edba5b46e46085
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b103da860b07b6caeef7231849386c8b9813f2fcc2fc8537c1924e67a92246bd
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 32D05E7565014477D2146B18EC47F563658970375AF000229F663C65D1D910A915E569
                                                                                                                                                                                                                                                          Function 0040D433 Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040D445
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: InitializeSecurity
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 640775948-0
                                                                                                                                                                                                                                                          • Opcode ID: 08574d9084c9b59a9be89533cd06f00eba31ac9089c6781083e346e8ebf9aaa5
                                                                                                                                                                                                                                                          • Instruction ID: f87055a7ed73e73a39e7b0bf2bc1a884afc0d8708234b3b1202e7b1dbc502a37
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 08574d9084c9b59a9be89533cd06f00eba31ac9089c6781083e346e8ebf9aaa5
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 52D0C9787D8305B7F6685B18EC17F1632505306F61F340229B366FF6D0C9D07901961C
                                                                                                                                                                                                                                                          Function 004404E2 Relevance: 1.5, APIs: 1, Instructions: 13memoryCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • RtlFreeHeap.NTDLL(?,00000000), ref: 004404FD
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: FreeHeap
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 3298025750-0
                                                                                                                                                                                                                                                          • Opcode ID: ffaa9ae7a0f019c742f1804f8799764577334675712f88277fcdd572fe457cd5
                                                                                                                                                                                                                                                          • Instruction ID: e6622cb3e0fd9e941ff1a23b217b6006838c210e8ccdd082eec4ddb73310e109
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ffaa9ae7a0f019c742f1804f8799764577334675712f88277fcdd572fe457cd5
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4AC08C31504922EBC7102F28BC16BC63A14EF02762F0748B1F000A90B5C728EC91C9D8
                                                                                                                                                                                                                                                          Function 004404B0 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • RtlAllocateHeap.NTDLL(?,00000000,?,00000001,00408C27,FDFCE302), ref: 004404C0
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: AllocateHeap
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 1279760036-0
                                                                                                                                                                                                                                                          • Opcode ID: 1b7010b4c8090af6c82bcce16cf64795d3be7dfa4a7c6d6e8218ea40ee4cb554
                                                                                                                                                                                                                                                          • Instruction ID: a3e7d273c8645b615fb13e0d68042f64d6ea605513032f2b713a79b74872f641
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1b7010b4c8090af6c82bcce16cf64795d3be7dfa4a7c6d6e8218ea40ee4cb554
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: CFC04871045220ABDA502B25EC09BCA3A68AF46662F0280A6B044A70B2C760AC82CA98

                                                                                                                                                                                                                                                          Non-executed Functions

                                                                                                                                                                                                                                                          Function 0041618C Relevance: 14.8, Strings: 11, Instructions: 1044COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: 6$6y$EnA$YjM$YjM$fjM$fjM$pSlM$yx$y~${
                                                                                                                                                                                                                                                          • API String ID: 0-2342033412
                                                                                                                                                                                                                                                          • Opcode ID: bcc76d1abf98286d77b35e6a0b09e71a8baff3536dadb212a893043a5b643fc1
                                                                                                                                                                                                                                                          • Instruction ID: a2001c8a8adb2b8dbf3dd01cda6d968c98786edfc2a21b29c8f54ffb17cc71b7
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bcc76d1abf98286d77b35e6a0b09e71a8baff3536dadb212a893043a5b643fc1
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9762E3741083418FE724CF25C891BAB77E1FF86314F15496DE0D69B2A2D738D84ACB9A
                                                                                                                                                                                                                                                          Function 0040B280 Relevance: 10.4, Strings: 8, Instructions: 384COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: )Ku$DM_e$S;G%$SV$UGEA$c[G$ox}k$x[G
                                                                                                                                                                                                                                                          • API String ID: 0-3323421312
                                                                                                                                                                                                                                                          • Opcode ID: 955f6e51a34149f4c10f413aa8795b1a1dd05340e96898ae9af78c9a06cf57c5
                                                                                                                                                                                                                                                          • Instruction ID: 7fd46061e40033794bbc6c3ce90a1e611a10dbdcf815d020572bc93dee4dedaf
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 955f6e51a34149f4c10f413aa8795b1a1dd05340e96898ae9af78c9a06cf57c5
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 55D1F57150C3408BD724CF29845476BFBE2EFD1708F18896DE4D56B385D77A890A8B8B
                                                                                                                                                                                                                                                          Function 00409360 Relevance: 10.3, Strings: 8, Instructions: 272COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: ADTD$E$ID$Y$eMOK$vu$vxtq$|xzy
                                                                                                                                                                                                                                                          • API String ID: 0-1466227541
                                                                                                                                                                                                                                                          • Opcode ID: 694bb15107f4bc877fab139e9b3cb1dd418c9edad3bc46051563358933346528
                                                                                                                                                                                                                                                          • Instruction ID: 68c016febbe7a0715404e25fe2d2c1f5bf377f828986e49a58439a2b7b357855
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 694bb15107f4bc877fab139e9b3cb1dd418c9edad3bc46051563358933346528
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7871E23158C3928AD3118F7AC4A076BFFE09FA2350F1C496DE4D45B392D37989099B9A
                                                                                                                                                                                                                                                          Function 0042A7F0 Relevance: 9.3, APIs: 2, Strings: 3, Instructions: 573COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 0042A8F7
                                                                                                                                                                                                                                                          • RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?,?), ref: 0042A9CF
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: EnvironmentExpandStrings
                                                                                                                                                                                                                                                          • String ID: *$*$q
                                                                                                                                                                                                                                                          • API String ID: 237503144-4001757600
                                                                                                                                                                                                                                                          • Opcode ID: 5f672a718d274909524f70c82779d112448254364d71578b31479b925a6e829e
                                                                                                                                                                                                                                                          • Instruction ID: 6a2a75fc59155a11c5aec0aea031f7e0da65668b1aff7312ce30b4a80edc4f4b
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5f672a718d274909524f70c82779d112448254364d71578b31479b925a6e829e
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 130212B56083158FD724CF28D89135FB7E1FFC5308F05892DE9999B291DB78890ACB86
                                                                                                                                                                                                                                                          Function 00437A60 Relevance: 9.1, APIs: 6, Instructions: 119clipboardCOMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: Clipboard$Global$CloseDataLockOpenUnlock
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 1006321803-0
                                                                                                                                                                                                                                                          • Opcode ID: 0d51a4dc2fe6236f60cf615c35f494bc4f8871562ce58d512750188790d88ec3
                                                                                                                                                                                                                                                          • Instruction ID: cc871ad810d5ebcc8503e7b8c4c024891cf7c86b0654bd3a3462fcbae073f9f9
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0d51a4dc2fe6236f60cf615c35f494bc4f8871562ce58d512750188790d88ec3
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0B41ABB010C7818FE310EF78944936FBFE0AB96308F09496EE4C586282D67C858DD7A7
                                                                                                                                                                                                                                                          Function 00419B30 Relevance: 7.9, APIs: 2, Strings: 2, Instructions: 947COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?), ref: 00419FF7
                                                                                                                                                                                                                                                          • FreeLibrary.KERNEL32(?), ref: 0041A039
                                                                                                                                                                                                                                                            • Part of subcall function 00442080: LdrInitializeThunk.NTDLL(0044523A,?,00000018,?,?,00000018,?,?,?), ref: 004420AE
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: FreeLibrary$InitializeThunk
                                                                                                                                                                                                                                                          • String ID: mj$Mw
                                                                                                                                                                                                                                                          • API String ID: 764372645-759178101
                                                                                                                                                                                                                                                          • Opcode ID: c086cc875a9495cf51c40eac8dc5e50a76db1f680bda795562031d64835a4f2b
                                                                                                                                                                                                                                                          • Instruction ID: e4b45be28fd4c7cbff433e2c06fe463db16693d42f5f124cafcdabba2620905a
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c086cc875a9495cf51c40eac8dc5e50a76db1f680bda795562031d64835a4f2b
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D76223746093009FE724CF25CC507ABBBE2BB85318F24861EE594573A1E7399C96CB4B
                                                                                                                                                                                                                                                          Function 00425DA0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 232COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00425E98
                                                                                                                                                                                                                                                          • RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 00425F24
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: EnvironmentExpandStrings
                                                                                                                                                                                                                                                          • String ID: 23
                                                                                                                                                                                                                                                          • API String ID: 237503144-326707096
                                                                                                                                                                                                                                                          • Opcode ID: 68f62ab6bbdc17d543da7d6c80b4e2832be22e5d8e63cefdd40be9526a9cccd6
                                                                                                                                                                                                                                                          • Instruction ID: b6730ddf130f4e2a19c05504fd255247e3d11648143caf2c2a016be5e81be571
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 68f62ab6bbdc17d543da7d6c80b4e2832be22e5d8e63cefdd40be9526a9cccd6
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7B7112B1A043189FEB20CFA8D841BEEBBB1FB45304F10843DE905AB2C5D775590ACB89
                                                                                                                                                                                                                                                          Function 00429917 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 230COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00429C9A
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: EnvironmentExpandStrings
                                                                                                                                                                                                                                                          • String ID: 67
                                                                                                                                                                                                                                                          • API String ID: 237503144-1886922373
                                                                                                                                                                                                                                                          • Opcode ID: efaa971be64e3f0e55855db326838b403e2c0136300b1c41449d082944818f00
                                                                                                                                                                                                                                                          • Instruction ID: a5821a17d697f7f316c5e23e8fd2eb7e472b5f5b3478a77b5a5598d7e69c89e3
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: efaa971be64e3f0e55855db326838b403e2c0136300b1c41449d082944818f00
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6D61F0B66083408BD724DF29E88175FB7E1EBC9304F18493DE58997281DB35D905CB8A
                                                                                                                                                                                                                                                          Function 00429B7B Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 217COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00429C9A
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: EnvironmentExpandStrings
                                                                                                                                                                                                                                                          • String ID: 67
                                                                                                                                                                                                                                                          • API String ID: 237503144-1886922373
                                                                                                                                                                                                                                                          • Opcode ID: 38b103ba2a0b24bd1f0b7068b570aa69e159151b381139e18933ad9306aeec92
                                                                                                                                                                                                                                                          • Instruction ID: 7ba92da05bbbaddbc1e3305b36c9b0db2ded0e94f959a81563e8173db3a816b3
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 38b103ba2a0b24bd1f0b7068b570aa69e159151b381139e18933ad9306aeec92
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: A961FEB66083408FD724DF25D88176FBBE2EBC9304F19493DE5898B281DB75C805CB8A
                                                                                                                                                                                                                                                          Function 00427FC0 Relevance: 5.4, Strings: 4, Instructions: 431COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: #C}$@-$up$vC
                                                                                                                                                                                                                                                          • API String ID: 0-3794437364
                                                                                                                                                                                                                                                          • Opcode ID: fe4f9d4565ffa40ec65875b6bd9e8bbb556a4c85dd3c3c1a3913f1bfe2a2c7a4
                                                                                                                                                                                                                                                          • Instruction ID: 145fb0a50be3e303ead08e2671ce65b3aa3df702a645c1f6ac8533401e1fa356
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: fe4f9d4565ffa40ec65875b6bd9e8bbb556a4c85dd3c3c1a3913f1bfe2a2c7a4
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 9FE1EBB5209340DFE324DF25E88076FBBE1FB86304F54882EE5898B251DB35D945CB9A
                                                                                                                                                                                                                                                          Function 004437D0 Relevance: 4.4, Strings: 3, Instructions: 647COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: M;D$>D$UUK
                                                                                                                                                                                                                                                          • API String ID: 0-3649699930
                                                                                                                                                                                                                                                          • Opcode ID: 8ead049028bc91adeff9622f45da0367f919806cf8365be0a15fc24cee2962a3
                                                                                                                                                                                                                                                          • Instruction ID: fc75cb93acbb787b45c4a477a4821f2fed63727632898f6dbcded6a89fb42fc6
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 8ead049028bc91adeff9622f45da0367f919806cf8365be0a15fc24cee2962a3
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8E22FE3AA08310CFD314DF29E89072BB7E2FB8A315F4A887DD58987361E674D941CB85
                                                                                                                                                                                                                                                          Function 004438E0 Relevance: 4.3, Strings: 3, Instructions: 577COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: M;D$>D$UUK
                                                                                                                                                                                                                                                          • API String ID: 0-3649699930
                                                                                                                                                                                                                                                          • Opcode ID: a4518d19f3d5ce0a92a9632ab1dce3ca5ef1e8b59513adf0c60c32138287e5c1
                                                                                                                                                                                                                                                          • Instruction ID: 5b6f0a5fe011b24c48fd64f61fb35041aa1557f3f4dce62c9b8353607a503f3b
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a4518d19f3d5ce0a92a9632ab1dce3ca5ef1e8b59513adf0c60c32138287e5c1
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5402DD39A08310CFE314CF29D89072BB7E2BBDA305F4A887DD589873A1D675D945CB85
                                                                                                                                                                                                                                                          Function 004438FB Relevance: 4.3, Strings: 3, Instructions: 566COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: M;D$>D$UUK
                                                                                                                                                                                                                                                          • API String ID: 0-3649699930
                                                                                                                                                                                                                                                          • Opcode ID: 0e38d297613c04bad4889370033c92b5e70b601f85af2d172c698d41d8b03cdb
                                                                                                                                                                                                                                                          • Instruction ID: 0ffe7b29edef83b041ea382641fdc4149dbc112461c51243b49d827887b3597f
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0e38d297613c04bad4889370033c92b5e70b601f85af2d172c698d41d8b03cdb
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2202DD3AA08310CFD314CF29D89072BB7E2BBDA305F4A887DD589873A2D675D945CB85
                                                                                                                                                                                                                                                          Function 004438F9 Relevance: 4.3, Strings: 3, Instructions: 565COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: M;D$>D$UUK
                                                                                                                                                                                                                                                          • API String ID: 0-3649699930
                                                                                                                                                                                                                                                          • Opcode ID: f19334b376416346e53576ffb4c07c93724e4cf39114a0a055eb46b0a26280a2
                                                                                                                                                                                                                                                          • Instruction ID: 86640fba6bac160b05b0c43110ab63d66e8f7ec2f5acf9dcdae8f0d28c6b6e57
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f19334b376416346e53576ffb4c07c93724e4cf39114a0a055eb46b0a26280a2
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8002ED3AA08310CFD314CF29D89072BB7E2BBDA305F4A887DD589873A1D675D945CB85
                                                                                                                                                                                                                                                          Function 00422370 Relevance: 4.2, Strings: 3, Instructions: 457COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: -jkhanold~m`$anold~m`$d~m`
                                                                                                                                                                                                                                                          • API String ID: 0-185452761
                                                                                                                                                                                                                                                          • Opcode ID: d49d82f6dee0b69ccdeb9ac9c72559ba4ec1d23df509649ca449329d3e76b77d
                                                                                                                                                                                                                                                          • Instruction ID: c4d8edb6bc4b196318c262ba746bf01715a487006edf2819d48878c0ea44a364
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d49d82f6dee0b69ccdeb9ac9c72559ba4ec1d23df509649ca449329d3e76b77d
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: C8D1BBB06083509FD710DF68D892B6BBBE0FF85318F54491DE8958B392E7B8D809CB56
                                                                                                                                                                                                                                                          Function 00422880 Relevance: 3.0, Strings: 2, Instructions: 455COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: !'$27
                                                                                                                                                                                                                                                          • API String ID: 0-1982139352
                                                                                                                                                                                                                                                          • Opcode ID: f59c36ea8d3009de80897bc285a486c4a8992c853654d8c5358ed7f8b9326bec
                                                                                                                                                                                                                                                          • Instruction ID: 5153aecd17f80642fd8c0eece016e91168ea77982d201b76830abc39117f0e9e
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: f59c36ea8d3009de80897bc285a486c4a8992c853654d8c5358ed7f8b9326bec
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F5C156B57083109BD7149F29DD9276BB7E1EF81314F88852EE8C58B391E6BCD904C35A
                                                                                                                                                                                                                                                          Function 004195B6 Relevance: 2.9, Strings: 2, Instructions: 363COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: =$^\
                                                                                                                                                                                                                                                          • API String ID: 0-3808277151
                                                                                                                                                                                                                                                          • Opcode ID: 3ae2f5be3b5b97ffa114b6693e049356c5b1626121661ef7d8dd4ce1dd7da5ce
                                                                                                                                                                                                                                                          • Instruction ID: 449fbb577030d5845b3ff3c78ea8df1dbbecff39a5bc4c3e86ed8d0a83d476b4
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3ae2f5be3b5b97ffa114b6693e049356c5b1626121661ef7d8dd4ce1dd7da5ce
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 20B1E6B56483428BD328DF25C8A07ABBBE1EFD5315F08892DE4D58B381E77C8845C796
                                                                                                                                                                                                                                                          Function 0043E6E0 Relevance: 2.0, Strings: 1, Instructions: 749COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: XY
                                                                                                                                                                                                                                                          • API String ID: 0-554446067
                                                                                                                                                                                                                                                          • Opcode ID: 33b58009a0d275d92ce311614dd2e3f5199f03ee560553effbe1cdfd0aaf5a3f
                                                                                                                                                                                                                                                          • Instruction ID: d641272ad35b4eeebbd9d600f92596cd8dd7c25af792fba6638ab3cd001d37ae
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 33b58009a0d275d92ce311614dd2e3f5199f03ee560553effbe1cdfd0aaf5a3f
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 3D322F3AA18351CBC7149F28D91236BB7E1EF8A300F09D97ED4C997291E7B8C945C786
                                                                                                                                                                                                                                                          Function 0042AF92 Relevance: 2.0, Strings: 1, Instructions: 719COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: q
                                                                                                                                                                                                                                                          • API String ID: 0-3900047139
                                                                                                                                                                                                                                                          • Opcode ID: 028d739358c52e8602972a09d323f6bdb4925b84f419e3085169aae73bae586d
                                                                                                                                                                                                                                                          • Instruction ID: d2894ee3cd08ac16c3749e12b5b110520c9353356bc4cfd2bf9c021bc54d189f
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 028d739358c52e8602972a09d323f6bdb4925b84f419e3085169aae73bae586d
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: B522F1B4608311CBD714CF64D8A176BB7F1FF96318F48896DE8854B391E7788906CB8A
                                                                                                                                                                                                                                                          Function 00414C30 Relevance: 1.6, Strings: 1, Instructions: 384COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: "PA
                                                                                                                                                                                                                                                          • API String ID: 0-2145937358
                                                                                                                                                                                                                                                          • Opcode ID: bef77be7770c426e390176cbba11156bb761573cd05d219cd3a7b36ea03102e9
                                                                                                                                                                                                                                                          • Instruction ID: f624a7b71cbf7b314e20e1a45d24be04a38f24c047e10d0676dafeec8f7fc991
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: bef77be7770c426e390176cbba11156bb761573cd05d219cd3a7b36ea03102e9
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 5CA102B15183118BD7189F28D8627ABB3E1EFD2314F09892EE8C58B390F77C9945C796
                                                                                                                                                                                                                                                          Function 0041BA52 Relevance: 1.5, Strings: 1, Instructions: 293COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: x(m.
                                                                                                                                                                                                                                                          • API String ID: 0-3038009362
                                                                                                                                                                                                                                                          • Opcode ID: 2334306b3d1fa9529e9ef949cf5e5337414280495606308dda49b0f52e9ab68a
                                                                                                                                                                                                                                                          • Instruction ID: 8fe95d6803831fae5c575aca5061d2950839e556567635e7946eadf65fb6b687
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2334306b3d1fa9529e9ef949cf5e5337414280495606308dda49b0f52e9ab68a
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: F27128B2A083108BD3248F25C4D03A7B7E1EFDA314F19595DE8C66B391E7788945C7D6
                                                                                                                                                                                                                                                          Function 0042AFB0 Relevance: 1.5, Strings: 1, Instructions: 222COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: q
                                                                                                                                                                                                                                                          • API String ID: 0-3900047139
                                                                                                                                                                                                                                                          • Opcode ID: 6b5437a597b224c58c18eff0cd7f9e1b12adb8a3c204c60dfaa919d9716313ac
                                                                                                                                                                                                                                                          • Instruction ID: bfd71d5ee42355939c062a028dadac58486c6c85aba871825f936092bfaa215d
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 6b5437a597b224c58c18eff0cd7f9e1b12adb8a3c204c60dfaa919d9716313ac
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: AC5103B4604310CBD7209F24E85176B73E1FF85318F54456DE9898B3A1E739D92ACB8B
                                                                                                                                                                                                                                                          Function 00418492 Relevance: 1.4, Strings: 1, Instructions: 158COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: (
                                                                                                                                                                                                                                                          • API String ID: 0-3887548279
                                                                                                                                                                                                                                                          • Opcode ID: ee7fa4accd31e59d0910d8aa9e7224e6b0750909148df57fa657f99ce6b3dc18
                                                                                                                                                                                                                                                          • Instruction ID: 2caae83b2d4013721f210141ccc417c30349dd5d0901d4fb7f3c841e3804c493
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ee7fa4accd31e59d0910d8aa9e7224e6b0750909148df57fa657f99ce6b3dc18
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: E851DE74109780DFDB209F24D859BABB7E5FF92314F09096DE4C98B2A1EB388514CB5B
                                                                                                                                                                                                                                                          Function 00417054 Relevance: 1.4, Strings: 1, Instructions: 146COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: rA
                                                                                                                                                                                                                                                          • API String ID: 0-3688822144
                                                                                                                                                                                                                                                          • Opcode ID: 0fecef19979ae2520a6d41ae5022304e5fe91d9e10e30bf12275cb775264daa6
                                                                                                                                                                                                                                                          • Instruction ID: eea7f0b4564a115e112266a705f564882217ee49f10fc6db0b082ff3a9467cbb
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 0fecef19979ae2520a6d41ae5022304e5fe91d9e10e30bf12275cb775264daa6
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 21410B3565C7824BD336CE7984903ABBBD2ABC6310F0C8A7D94D197785DE7CC8468752
                                                                                                                                                                                                                                                          Function 004421E9 Relevance: 1.3, Strings: 1, Instructions: 96COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: "c_
                                                                                                                                                                                                                                                          • API String ID: 0-1905016733
                                                                                                                                                                                                                                                          • Opcode ID: 54f33eb4d3c200ec803ec730c350af6742ffe7018a8b1e5f7191d90e9f16e4db
                                                                                                                                                                                                                                                          • Instruction ID: 139d9a56c6b22736b00f81c9c0a59650492495ee9bcb90bc8dd56261b9d87cf4
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 54f33eb4d3c200ec803ec730c350af6742ffe7018a8b1e5f7191d90e9f16e4db
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7331F172E055018FC319CF2CC8623A6FBA2FB59308F19D12CC555A7796C7B9A80A8B84
                                                                                                                                                                                                                                                          Function 0041B58F Relevance: 1.3, Strings: 1, Instructions: 79COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: %
                                                                                                                                                                                                                                                          • API String ID: 0-2567322570
                                                                                                                                                                                                                                                          • Opcode ID: 2611800c88671bb526049112999962ec915228d777db172c398fa2dfb9493879
                                                                                                                                                                                                                                                          • Instruction ID: fc55fbf2e67d6e55d69b8bdcc21a86b947583cb7b9fc2e15381c79fb32be4bbc
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 2611800c88671bb526049112999962ec915228d777db172c398fa2dfb9493879
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 492125315583508FD3248F24C854B6ABBE0EF9A318F084A5EE4D5EB392C379C945CB8B
                                                                                                                                                                                                                                                          Function 00427FFD Relevance: 1.3, Strings: 1, Instructions: 67COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID: UZW
                                                                                                                                                                                                                                                          • API String ID: 0-4101217444
                                                                                                                                                                                                                                                          • Opcode ID: 214fb597cb98695a4d45f46ce28af4813d836258ed31ce56576b7396067f434c
                                                                                                                                                                                                                                                          • Instruction ID: beb92d7dceb5f7ee2bc2359878695b6a9a5b74cab8484de6a3c22e177f9b20e4
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 214fb597cb98695a4d45f46ce28af4813d836258ed31ce56576b7396067f434c
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2D21E7706093618BD7209F65E89577FB7E1EF92308F44082EE5C187252EB7DC806CB5A
                                                                                                                                                                                                                                                          Function 00407730 Relevance: .6, Instructions: 613COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                          • Opcode ID: b3a201b8e5456e04acd6c277bd4f9cc362c0339010213f8c812fce2c91a647e3
                                                                                                                                                                                                                                                          • Instruction ID: 81516d2b71f578880f32ea2fb0b1a758f5866deba3e580c85c02b3815e78599f
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: b3a201b8e5456e04acd6c277bd4f9cc362c0339010213f8c812fce2c91a647e3
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 92129432A0C7118BD725DF18D8806ABB3E1BFD4319F19893ED586A7381D738B8518B87
                                                                                                                                                                                                                                                          Function 00428C62 Relevance: .4, Instructions: 434COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                          • Opcode ID: 27528c4e1026f15c8b4d8e22d8fc954aa3de2470dcd330dc5e4b4ed7aeb3421c
                                                                                                                                                                                                                                                          • Instruction ID: 94ada5613fcb5724ef714f3b33f4bba041d2705c14d30676149ca7069553ac03
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 27528c4e1026f15c8b4d8e22d8fc954aa3de2470dcd330dc5e4b4ed7aeb3421c
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 55C126B560D351CFD7048F24E85126BBBE1EF96304F18486EE4C597342DB39D906CB9A
                                                                                                                                                                                                                                                          Function 00427C10 Relevance: .3, Instructions: 277COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                          • Opcode ID: 1255f4a16ea10230f8237e4c05ad8c588ba4ba9d264dd35e923e8e3087f5a603
                                                                                                                                                                                                                                                          • Instruction ID: 2111fa9e304b48309700938602874aac4406f1930da0b205156c5b471cdf0221
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 1255f4a16ea10230f8237e4c05ad8c588ba4ba9d264dd35e923e8e3087f5a603
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 4F81477564C3508BC3109F28D88176BBBE1EF91318F488A2EF9D85B381E7788949C787
                                                                                                                                                                                                                                                          Function 00427885 Relevance: .2, Instructions: 211COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                          • Opcode ID: 969304de8e2ff430d6fed9e82d3ec5cb1b50224069e0a7491f59bb6e4dd82972
                                                                                                                                                                                                                                                          • Instruction ID: 1d0bc7c47f9e9f486bda4e769dd1419a7faa478ba188ee17b6b14aa8c80eb475
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 969304de8e2ff430d6fed9e82d3ec5cb1b50224069e0a7491f59bb6e4dd82972
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7F613672B5C3A28BD7348F2894513ABB7E1EF56350F84893ED4D987381E2389905D39B
                                                                                                                                                                                                                                                          Function 0041F170 Relevance: .2, Instructions: 204COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                          • Opcode ID: c5d0b943f9de84774c78a780ad13b19ed83386de1e9444702bd5e4860ce26029
                                                                                                                                                                                                                                                          • Instruction ID: a6ce5babd4d3766fd429a0d32157edeb31411bafb66deedf712a04b4dc43084b
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: c5d0b943f9de84774c78a780ad13b19ed83386de1e9444702bd5e4860ce26029
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 8C615A355083949FC7258F39C85096E7BD0AF95314F0881BEE8E447392D639DC4AC756
                                                                                                                                                                                                                                                          Function 0041AB90 Relevance: .2, Instructions: 196COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                          • Opcode ID: a1aac728ee4b4832bd396a6b465bb79e7de6bf291210a6027f85529f027abc15
                                                                                                                                                                                                                                                          • Instruction ID: 96be8bd36e56bf27b6aa0d10c1fb3a2b8c76be11eb878f6b8047cc8e026e4330
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: a1aac728ee4b4832bd396a6b465bb79e7de6bf291210a6027f85529f027abc15
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 0D5178B01093818BD310CF26C8617ABBBE1EFC6368F04595DE4D58B791E3788549CB9B
                                                                                                                                                                                                                                                          Function 0041A770 Relevance: .2, Instructions: 170COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                          • Opcode ID: d1b575b9db7d3d251ac50788cacbe8e7486d039b173afaa70e00c3db702b2f36
                                                                                                                                                                                                                                                          • Instruction ID: c8fa41b63414d86ae28ae5069bc9de9cc5c1be9fc68955ccb818d97c0d6e7456
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: d1b575b9db7d3d251ac50788cacbe8e7486d039b173afaa70e00c3db702b2f36
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 935123542087904ADB00DF7588D2A3A7BF0DF48305B0960DFD898DF7A7E638D2168B8E
                                                                                                                                                                                                                                                          Function 00402210 Relevance: .2, Instructions: 166COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                          • Opcode ID: 5c7e2a066f6d9e345ae6dd4228410094820ea6aa83ba62684cec3428317f83b8
                                                                                                                                                                                                                                                          • Instruction ID: ddd3a1f12e0d028ceadd4f9d033f63418dc44a780f61091206b315d12a6ba213
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5c7e2a066f6d9e345ae6dd4228410094820ea6aa83ba62684cec3428317f83b8
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 955182B18007059BD3209F68AD48717B7B4BB41328F14073DECA5A73E1E779EA15CB8A
                                                                                                                                                                                                                                                          Function 0043CD40 Relevance: .1, Instructions: 143COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                          • Opcode ID: 549b4f452cc201c5641bd5c19871334d83eb667d6dce25a4303c69a392540114
                                                                                                                                                                                                                                                          • Instruction ID: 21a2246a7d2b4b35dc494bba2f4b78631a10c89df9ac8d713cd23d0779d29278
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 549b4f452cc201c5641bd5c19871334d83eb667d6dce25a4303c69a392540114
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D4310372B456104BC318DA29CC823ABB7D297C9324F0AD63AE898D73D4E63CCC418791
                                                                                                                                                                                                                                                          Function 0041B021 Relevance: .1, Instructions: 114COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                          • Opcode ID: fbbfd85ed4625c5c4a602328de8fb4c924b8bb4c62c88757fd3e9dc444327da8
                                                                                                                                                                                                                                                          • Instruction ID: 6c2a7a40945fba97b60b2dc016bc6914b469ce470df0d3b36ab1ee23dd066ef4
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: fbbfd85ed4625c5c4a602328de8fb4c924b8bb4c62c88757fd3e9dc444327da8
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 763159759483819BD718CB34C8A13BBBBD19B97318F189A2DE0E193391D338C5468B5B
                                                                                                                                                                                                                                                          Function 00431AF5 Relevance: .1, Instructions: 109COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                          • Opcode ID: 41305cf3b9d177b5ddb8f36fbe4dc537e4b4ae08f3accfdb3d01e3decd18bcb9
                                                                                                                                                                                                                                                          • Instruction ID: c3ef201410797beedfbb423dd4b6a4b613f7a1191b873fa7b6aad00fbf48a4bb
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 41305cf3b9d177b5ddb8f36fbe4dc537e4b4ae08f3accfdb3d01e3decd18bcb9
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: D3210B6590D3C146D7394B3A44243B7EFE25FE7345F2C58AED0D987392DA798005871A
                                                                                                                                                                                                                                                          Function 00408320 Relevance: .1, Instructions: 107COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                          • Opcode ID: 080992afd48c0527231705f8ceffc0aba193dc8929bd9ea4cd8631f6a582b227
                                                                                                                                                                                                                                                          • Instruction ID: b0168b037b63377ee53a696943b9184fc20a9d47a10823b489a3532680c59eb7
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 080992afd48c0527231705f8ceffc0aba193dc8929bd9ea4cd8631f6a582b227
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7B314B2290D6F30EC336892D449047E7AA05AE621472943FFDCF19B3C3C52AC94587E5
                                                                                                                                                                                                                                                          Function 0041B3F2 Relevance: .1, Instructions: 96COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                          • Opcode ID: eaf3a552830be57f3b076121e3f4128acb6b5eaa3b8ddd6eb86dc69abef60401
                                                                                                                                                                                                                                                          • Instruction ID: f625d5dc7cc146dca826755e11d0e3d06b3d9b76c6b30af6ca5c7fe59dabf8e9
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: eaf3a552830be57f3b076121e3f4128acb6b5eaa3b8ddd6eb86dc69abef60401
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 2C31F2766183418BD708CF39C89136BBBE2AB86318F18CA6DE4D1D7384D73C88458B92
                                                                                                                                                                                                                                                          Function 0043A230 Relevance: .1, Instructions: 64COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                          • Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
                                                                                                                                                                                                                                                          • Instruction ID: 34218d49f98f4d04757d6d7688404ab739ac49d953720a668d3546879b641f63
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7411EC336491D40EC7158D3C8400566BF930A97735F1993DAF4F4973D2D52B8D8E835A
                                                                                                                                                                                                                                                          Function 0042C5E0 Relevance: .1, Instructions: 63COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                          • Opcode ID: 5b0bd2af23d8aba3338285f4a2fcfdf2a171a9890d65b304db72d3eef606dba8
                                                                                                                                                                                                                                                          • Instruction ID: e2b1fa06f32b2fd48b90287ee0e38661db697dc0127cfdde8b5722762f88e760
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 5b0bd2af23d8aba3338285f4a2fcfdf2a171a9890d65b304db72d3eef606dba8
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 440192F170171197DA209E15A5C172BB2A85F90708F18543ED84457342EB7DEC08C2DD
                                                                                                                                                                                                                                                          Function 00440A90 Relevance: .0, Instructions: 46COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: InitializeThunk
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID: 2994545307-0
                                                                                                                                                                                                                                                          • Opcode ID: 88e438cc32f6b5a12cb4a8709c5ccb5f2cf69f7e5815e22606a40b63f7bc33cd
                                                                                                                                                                                                                                                          • Instruction ID: 7b6863c9c9260bd0558c6f806dd5f9e3415f7290086a878cc0b8c3271b95cfd7
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 88e438cc32f6b5a12cb4a8709c5ccb5f2cf69f7e5815e22606a40b63f7bc33cd
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6EF0F936544304ABE1105B459C40D3777AEFB9E728F104319F715332A1E772ED2197A9
                                                                                                                                                                                                                                                          Function 0041F3E0 Relevance: .0, Instructions: 21COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID:
                                                                                                                                                                                                                                                          • String ID:
                                                                                                                                                                                                                                                          • API String ID:
                                                                                                                                                                                                                                                          • Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
                                                                                                                                                                                                                                                          • Instruction ID: 65b04920acd8ec40befbc16cdab85cd19ddd64fc0dfac740f80379ed40623b4a
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 7CD0A7715487B50E57588D3C44A04BBFBE8E987712B1814AFE8D6E3206D225DC47469D
                                                                                                                                                                                                                                                          Function 00425560 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 123COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          • RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 0042561D
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: EnvironmentExpandStrings
                                                                                                                                                                                                                                                          • String ID: $%$p:#$MO
                                                                                                                                                                                                                                                          • API String ID: 237503144-3521940197
                                                                                                                                                                                                                                                          • Opcode ID: 23a9facff3ed32d27b45f5c78396115d40fb07a2703201d84f017c1d29451edb
                                                                                                                                                                                                                                                          • Instruction ID: 81944db62257c61826c9772faf3d9c506449667b4075365b7c5b7f4bc0eeec7d
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 23a9facff3ed32d27b45f5c78396115d40fb07a2703201d84f017c1d29451edb
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 6141DF365183448FE310CF24C88475FBBE2FFC5758F16892CE4D49B680D6B9CA0A8B86
                                                                                                                                                                                                                                                          Function 0040C050 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                                          Download Yara Rule
                                                                                                                                                                                                                                                          APIs
                                                                                                                                                                                                                                                          Strings
                                                                                                                                                                                                                                                          Memory Dump Source
                                                                                                                                                                                                                                                          • Source File: 0000000D.00000002.2180779738.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                          • Snapshot File: hcaresult_13_2_400000_db0740f8e4.jbxd
                                                                                                                                                                                                                                                          Similarity
                                                                                                                                                                                                                                                          • API ID: FreeLibrary
                                                                                                                                                                                                                                                          • String ID: Mw
                                                                                                                                                                                                                                                          • API String ID: 3664257935-2910736759
                                                                                                                                                                                                                                                          • Opcode ID: 27da7d1ecd683459e61e314d26d97e783c391c34258efece46d9df52749a6e00
                                                                                                                                                                                                                                                          • Instruction ID: 0ef2ccba0a006ca6fcd7738bd7119b4b32ceb5ba17d334e5b7befb7630811a2c
                                                                                                                                                                                                                                                          • Opcode Fuzzy Hash: 27da7d1ecd683459e61e314d26d97e783c391c34258efece46d9df52749a6e00
                                                                                                                                                                                                                                                          • Instruction Fuzzy Hash: 07C04C3D810404DFEF117FB7FE098183AB1FB4273A3140834F40241036DA264921EB1D