Edit tour

Windows Analysis Report
0039284903284902840932890840928091#U00aaharder.exe

Overview

General Information

Sample name:	0039284903284902840932890840928091#U00aaharder.exe renamed because original name is a hash value
Original sample name:	0039284903284902840932890840928091harder.exe
Analysis ID:	1501748
MD5:	4a91d764fb5563b771d2a07d0d8a1181
SHA1:	4f8717d5f7aef12b3405be7bad1fb8c5c91df7b9
SHA256:	1cc3219cfd16bf9e2a0e8e276d2c5bba24a70f214d2301e760ba1a9424bf0504
Tags:	exe
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Drops or copies MsMpEng.exe (Windows Defender, likely to bypass HIPS)

Machine Learning detection for dropped file

NDIS Filter Driver detected (likely used to intercept and sniff network traffic)

Sample is not signed and drops a device driver

Uses shutdown.exe to shutdown or reboot the system

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

0039284903284902840932890840928091#U00aaharder.exe (PID: 6252 cmdline: "C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe" MD5: 4A91D764FB5563B771D2A07D0D8A1181)

0039284903284902840932890840928091#U00aaharder.exe (PID: 6444 cmdline: "C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe" --rerunningWithoutUAC MD5: 4A91D764FB5563B771D2A07D0D8A1181)

Update.exe (PID: 6544 cmdline: "C:\Users\user\AppData\Local\SquirrelTemp\Update.exe" --install . --rerunningWithoutUAC MD5: A560BAD9E373EA5223792D60BEDE2B13)

Treatments?Secure.exe (PID: 1456 cmdline: "C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe" --squirrel-firstrun MD5: EF8AB76732B42F96F650419850193A0F)

cmd.exe (PID: 6580 cmdline: "C:\Windows\System32\cmd.exe" /C cd "C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0" & start Treatments?Secure.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Treatments?Secure.exe (PID: 6612 cmdline: Treatments?Secure.exe MD5: EF8AB76732B42F96F650419850193A0F)

cmd.exe (PID: 7380 cmdline: "C:\Windows\System32\cmd.exe" /C sc create MainSVCLine binPath= "C:\Program Files\Statistical Flexibility\MpDefenderCoreService.exe" start= auto & shutdown -r -t 0 -f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7448 cmdline: sc create MainSVCLine binPath= "C:\Program Files\Statistical Flexibility\MpDefenderCoreService.exe" start= auto MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

shutdown.exe (PID: 7468 cmdline: shutdown -r -t 0 -f MD5: F2A4E18DA72BB2C5B21076A5DE382A20)

svchost.exe (PID: 6096 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7732 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Update.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\TreatmentsSecure\Update.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
2.0.Update.exe.230000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: sc create MainSVCLine binPath= "C:\Program Files\Statistical Flexibility\MpDefenderCoreService.exe" start= auto , CommandLine: sc create MainSVCLine binPath= "C:\Program Files\Statistical Flexibility\MpDefenderCoreService.exe" start= auto , CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /C sc create MainSVCLine binPath= "C:\Program Files\Statistical Flexibility\MpDefenderCoreService.exe" start= auto & shutdown -r -t 0 -f, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7380, ParentProcessName: cmd.exe, ProcessCommandLine: sc create MainSVCLine binPath= "C:\Program Files\Statistical Flexibility\MpDefenderCoreService.exe" start= auto , ProcessId: 7448, ProcessName: sc.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6096, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Program Files\Statistical Flexibility\MpClient.dll	ReversingLabs: Detection: 21%
Source: C:\Program Files\Statistical Flexibility\MpDefenderCoreService.dll	ReversingLabs: Detection: 26%
Source: C:\Program Files\Statistical Flexibility\pt-BR\MpClient.dll	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	ReversingLabs: Detection: 13%

Machine Learning detection for dropped file

Source: C:\Program Files\Statistical Flexibility\MpClient.dll

Joe Sandbox ML: detected

Source: 0039284903284902840932890840928091#U00aaharder.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\part1.zip	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Main.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\part1.zip.bin	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\ThirdPartyNotices.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\com.microsoft.defender.be.chrome.json	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\com.microsoft.defender.be.firefox.json	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Microsoft-Antimalware-AMFilter.man	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Microsoft-Antimalware-NIS.man	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Microsoft-Antimalware-Protection.man	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Microsoft-Antimalware-RTP.man	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Microsoft-Antimalware-Service.man	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Microsoft-Windows-Windows Defender.man	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\mpextms.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MsMpEng.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\ProtectionManagement.mof	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\ProtectionManagement_Uninstall.mof	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\ConfigSecurityPolicy.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpCmdRun.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpCopyAccelerator.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpDefenderCoreService.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpDlpCmd.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpDlpService.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpSenseComm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpUpdate.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpUxAgent.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MsMpLics.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\ProtectionManagement.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\DefenderCSP.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpAsDesc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpCommu.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpDetours.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpDetoursCopyAccelerator.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpEvMsg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpOAV.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\pack01.zip	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\dllhost2.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\en-EN	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\en-EN\MpClient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\en-EN\MpDlpCmd.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\pt-BR	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\pt-BR\MpAsDesc.dll.mui	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\pt-BR\MpClient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\pt-BR\MpDlpCmd2.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\pt-BR\MpEvMsg.dll.mui	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\pt-BR\mpuxagent.dll.mui	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\pt-BR\ProtectionManagement.dll.mui	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Catalogs	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Catalogs\IGD.CAT	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Drivers	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Drivers\WdBoot.sys	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Drivers\WdDevFlt.sys	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Drivers\WdFilter.sys	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Drivers\WdNisDrv.sys	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Powershell	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Powershell\Defender.psd1	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Powershell\DefenderPerformance.psd1	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpComputerStatus.cdxml	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpPerformanceRecording.psm1	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpPerformanceRecording.wprp	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpPerformanceReport.Format.ps1xml	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpPreference.cdxml	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpRollback.cdxml	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpScan.cdxml	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpSignature.cdxml	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpThreat.cdxml	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpThreatCatalog.cdxml	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpThreatDetection.cdxml	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpWDOScan.cdxml	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpClient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpDefenderCoreService.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\BlanketFolding	Jump to behavior

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TreatmentsSecure

Jump to behavior

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

File created: C:\Users\user\AppData\Local\SquirrelTemp\Squirrel-Install.log

Jump to behavior

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

File created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Readme.txt

Jump to behavior

Source: 0039284903284902840932890840928091#U00aaharder.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\vcomp140d.i386.pdbGCTL source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: NisSrv.pdb source: dllhost2.exe.10.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\vcamp140.i386.pdbGCTL source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: netstandard.pdb.mdb source: Update.exe
Source:	Binary string: VaultRoaming.pdbUGP source: VaultRoaming.dll.2.dr
Source:	Binary string: WdBoot.pdb source: Treatments?Secure.exe, 0000000A.00000002.2921626182.0000024FA4072000.00000004.00000800.00020000.00000000.sdmp, Treatments?Secure.exe, 0000000A.00000002.2921626182.0000024FA4035000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: Update.exe, 00000002.00000002.1733253754.0000000002A8A000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\DeveloperSys\Documents\Embarcadero\Studio\Projects\DLL New Completa\Projeto C++\NewHorizon\x64\Release\NewHorizon.pdb source: Treatments?Secure.exe, 0000000A.00000002.2921626182.0000024FA3CB5000.00000004.00000800.00020000.00000000.sdmp, MpClient.dll0.10.dr
Source:	Binary string: vcamp120.i386.pdb source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140d.amd64.pdb/// source: Update.exe, 00000002.00000002.1733253754.0000000002A8A000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002A63000.00000004.00000800.00020000.00000000.sdmp, vcruntime140d.dll.2.dr
Source:	Binary string: MpSenseComm.pdbGCTL source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CA95000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\vcamp140.i386.pdb source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: vcamp120.i386.pdb8P source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: MpDetours.pdbGCTL source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8C992000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr, MpDetours.dll.10.dr
Source:	Binary string: slpts.pdb source: Update.exe, 00000002.00000002.1733253754.0000000002929000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002950000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: MpUxAgent.pdb source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: MpCommu.pdbGCTL source: MpCommu.dll.10.dr
Source:	Binary string: shellext.pdbOGPS source: shellext.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\vcomp140.i386.pdb source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: MpUxAgent.pdbGCTL source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: WdNisDrv.pdb source: Treatments?Secure.exe, 0000000A.00000002.2921626182.0000024FA4105000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: MsMpEng.pdbGCTL source: MsMpEng.exe.10.dr
Source:	Binary string: SmartcardCredentialProvider.pdb source: SmartcardCredentialProvider.dll.2.dr
Source:	Binary string: VaultRoaming.pdb source: VaultRoaming.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: Update.exe, 00000002.00000002.1733253754.0000000002A63000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002A3D000.00000004.00000800.00020000.00000000.sdmp, vcruntime140.dll.2.dr
Source:	Binary string: PhotoViewer.pdb source: PhotoViewer.dll.2.dr
Source:	Binary string: vccorlib120.i386.pdb source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: slpts.pdbL source: Update.exe, 00000002.00000002.1733253754.0000000002929000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002950000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\vcomp140d.i386.pdb source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140d.amd64.pdb source: Update.exe, 00000002.00000002.1733253754.0000000002A8A000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002A63000.00000004.00000800.00020000.00000000.sdmp, vcruntime140d.dll.2.dr
Source:	Binary string: MpUpdate.pdbGCTL source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: MpOAV.pdb source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CA95000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: MpOAV.pdbGCTL source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CA95000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: C:\Users\ani\code\squirrel\squirrel.windows\build\Release\Win32\StubExecutable.pdb source: Update.exe, 00000002.00000002.1733253754.0000000002A16000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.00000000029EB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\vcomp140.i386.pdbGCTL source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: MpDetoursCopyAccelerator.pdb source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CA79000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: vccorlib120.i386.pdb0 source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1d.amd64.pdb source: Update.exe, 00000002.00000002.1733253754.0000000002AD7000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: DefenderCSP.pdb source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8C992000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: shellext.pdb source: shellext.dll.2.dr
Source:	Binary string: vcomp120.i386.pdb0' source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: WdNisDrv.pdbGCTL source: Treatments?Secure.exe, 0000000A.00000002.2921626182.0000024FA4105000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: PhotoViewer.pdb@WH source: PhotoViewer.dll.2.dr
Source:	Binary string: MpDlpCmd.pdbGCTL source: MpDlpCmd2.exe.10.dr
Source:	Binary string: version.pdb source: Update.exe, 00000002.00000002.1733253754.0000000002B24000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002AFD000.00000004.00000800.00020000.00000000.sdmp, version.dll.2.dr
Source:	Binary string: C:\Users\ani\code\squirrel\squirrel.windows\build\Release\Win32\Setup.pdb source: 0039284903284902840932890840928091#U00aaharder.exe
Source:	Binary string: MpDetours.pdb source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8C992000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr, MpDetours.dll.10.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\vccorlib140.i386.pdb source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: SLWGA.pdb source: Update.exe, 00000002.00000002.1733253754.000000000295C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: vcomp120.i386.pdb source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: MpSenseComm.pdb source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CA95000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: MpCommu.pdb source: MpCommu.dll.10.dr
Source:	Binary string: MpDetoursCopyAccelerator.pdbGCTL source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CA79000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dllb.pdb source: Treatments?Secure.exe, 00000003.00000002.1754544140.000002CB8D02D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WdBoot.pdbGCTL source: Treatments?Secure.exe, 0000000A.00000002.2921626182.0000024FA4072000.00000004.00000800.00020000.00000000.sdmp, Treatments?Secure.exe, 0000000A.00000002.2921626182.0000024FA4035000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: NisSrv.pdbGCTL source: dllhost2.exe.10.dr
Source:	Binary string: MpDlpCmd.pdb source: MpDlpCmd2.exe.10.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1d.amd64.pdb""" source: Update.exe, 00000002.00000002.1733253754.0000000002AD7000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: MsMpEng.pdb source: MsMpEng.exe.10.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.pdb source: Treatments?Secure.exe, 00000003.00000002.1761057385.000002CBA92BD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: MpUpdate.pdb source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: SLWGA.pdbH source: Update.exe, 00000002.00000002.1733253754.000000000295C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\vccorlib140.i386.pdbGCTL source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: C:\Users\DeveloperSys\Documents\Embarcadero\Studio\Projects\DLL New Completa\Projeto C++\ScreenTake\x64\Release\ScreenTake.pdb source: Treatments?Secure.exe, 0000000A.00000002.2921626182.0000024FA3CB5000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreService.dll.10.dr
Source:	Binary string: DefenderCSP.pdbGCTL source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8C992000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\TreatmentsSecure\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\	Jump to behavior

Networking

NDIS Filter Driver detected (likely used to intercept and sniff network traffic)

Source: WdNisDrv.sys.10.dr

Static PE information: Found NDIS imports: FwpmTransactionAbort0, FwpmTransactionCommit0, FwpmTransactionBegin0, FwpmEngineOpen0, FwpmSubLayerAdd0, FwpmEngineClose0, FwpmFilterAdd0, FwpmCalloutAdd0, FwpmSubLayerDeleteByKey0, FwpmCalloutDeleteByKey0, FwpmFilterDeleteByKey0, FwpsCalloutUnregisterByKey0, FwpsQueryPacketInjectionState0, FwpsInjectTransportSendAsync0, FwpsStreamInjectAsync0, FwpsInjectionHandleDestroy0, FwpsInjectionHandleCreate0, FwpsFlowRemoveContext0, FwpsFlowAssociateContext0, FwpsCalloutRegister2, FwpsCalloutUnregisterById0, FwpsCopyStreamDataToBuffer0, FwpsFlowAbort0, FwpsAllocateNetBufferAndNetBufferList0, FwpsFreeNetBufferList0

Yara detected Generic Downloader

Source: Yara match	File source: Update.exe, type: SAMPLE
Source: Yara match	File source: 2.0.Update.exe.230000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\TreatmentsSecure\Update.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe, type: DROPPED

Source: dllhost2.exe.10.dr	String found in binary or memory: http://canonicalizer.ucsuri.tcs/68007400740070003a002f002f00httpsftp://map/set
Source: svchost.exe, 00000005.00000002.2921480958.000001DFCE000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: Update.exe, 00000002.00000002.1733253754.0000000002BBC000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002757000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/TreatmentsSecure.nuspec
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/TreatmentsSecure.nuspecz
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/_rels/.rels
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net48/AMMonitoringProvider.dll
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net48/ImagingEngine.dll
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net48/MpDetoursCopyAccelerator.dll
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net48/MpOAV.dll
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net48/PhotoAcq.dll
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net48/PhotoBase.dll
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net48/PhotoViewer.dll
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net48/Readme.txt
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net48/SmartCardSimulator.dll
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net48/SmartcardCredentialProvider.dll
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net48/Treatments?Secure.exe
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net48/Treatments?Secure.exez
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net48/Treatments?Secure_ExecutionStub.exe
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net48/VaultRoaming.dll
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net48/aeevts.dll
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net48/aeinv.dll
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net48/aelupsvc.dll
Source: Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net48/aelupsvc.dllz
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net48/aepdu.dll
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net48/part1.cab
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net48/shellext.dll
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net48/slpts.dll
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net48/slpts.dllz
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net48/slwga.dll
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net48/vcruntime140.dll
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net48/vcruntime140_1.dll
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net48/vcruntime140_1d.dll
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net48/vcruntime140d.dll
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net48/verifier.dll
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net48/version.dll
Source: Update.exe, 00000002.00000002.1733253754.0000000002BBC000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002757000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/package/services/metadata/core-properties/1fd1c4030bbc455c86f64fbcf96402fa.p
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.bsdiff
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.cab
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.diff
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.dll
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.exe
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.nuspec
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.psmdcp
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.rels
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.shasum
Source: Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.txt
Source: MpCommu.dll.10.dr	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest
Source: MpCommu.dll.10.dr	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: svchost.exe, 00000005.00000003.1727609289.000001DFCE218000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000005.00000003.1727609289.000001DFCE218000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000005.00000003.1727609289.000001DFCE218000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000005.00000003.1727609289.000001DFCE24D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.5.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.openxmlformats.or
Source: MpCommu.dll.10.dr	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: Treatments?Secure.exe, 00000003.00000002.1758368532.000002CB8ECA1000.00000004.00000800.00020000.00000000.sdmp, Treatments?Secure.exe, 0000000A.00000002.2921626182.0000024FA3B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Treatments?Secure.exe, 00000003.00000002.1758368532.000002CB8ECA1000.00000004.00000800.00020000.00000000.sdmp, Treatments?Secure.exe, 0000000A.00000002.2921626182.0000024FA3B11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/schoolDataSet.xsd
Source: Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CA95000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr	String found in binary or memory: http://www.validationtest.contoso.com/test%ld.htmlMpOAV_ForceDeepScan
Source: Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Update.exe	String found in binary or memory: https://api.github.com/#
Source: svchost.exe, 00000005.00000003.1727609289.000001DFCE2C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.5.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.5.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.5.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000005.00000003.1727609289.000001DFCE2C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.5.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: Update.exe	String found in binary or memory: https://github.com/myuser/myrepo
Source: svchost.exe, 00000005.00000003.1727609289.000001DFCE2C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.5.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

System Summary

Uses shutdown.exe to shutdown or reboot the system

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\shutdown.exe shutdown -r -t 0 -f

Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe

File created: C:\Program Files\Statistical Flexibility\Drivers\WdBoot.sys

Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 2_2_00007FFD9B8B8A08	2_2_00007FFD9B8B8A08
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 2_2_00007FFD9B8B0F18	2_2_00007FFD9B8B0F18
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 2_2_00007FFD9B8B0F25	2_2_00007FFD9B8B0F25
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 2_2_00007FFD9B8D41A0	2_2_00007FFD9B8D41A0
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 2_2_00007FFD9B8D313D	2_2_00007FFD9B8D313D
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Code function: 3_2_00007FFD9B89400E	3_2_00007FFD9B89400E
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Code function: 3_2_00007FFD9B8930E6	3_2_00007FFD9B8930E6
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Code function: 3_2_00007FFD9B893C6F	3_2_00007FFD9B893C6F
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Code function: 10_2_00007FFD9B8A3BF0	10_2_00007FFD9B8A3BF0
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Code function: 10_2_00007FFD9B8A400E	10_2_00007FFD9B8A400E
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Code function: 10_2_00007FFD9B8A306D	10_2_00007FFD9B8A306D
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Code function: 10_2_00007FFD9B8A3C1B	10_2_00007FFD9B8A3C1B

Source: Joe Sandbox View	Dropped File: C:\Program Files\Statistical Flexibility\ConfigSecurityPolicy.exe 76B1D718DA599A6BEE5AA5FBD7DFD031022A8331BDAE34267B0D4738CA96F6E4
Source: Joe Sandbox View	Dropped File: C:\Program Files\Statistical Flexibility\DefenderCSP.dll E4B475161E83CBF8B51D33D4425E7EDD6BDCB195D10B33DE46C8BBC555927731

Source: 0039284903284902840932890840928091#U00aaharder.exe	Static PE information: Resource name: DATA type: Zip archive data, at least v2.0 to extract, compression method=deflate
Source: verifier.dll.2.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)

Source: WdNisDrv.sys.10.dr	Static PE information: Number of sections : 11 > 10
Source: WdDevFlt.sys.10.dr	Static PE information: Number of sections : 11 > 10
Source: WdFilter.sys.10.dr	Static PE information: Number of sections : 12 > 10

Source: MpAsDesc.dll.mui.10.dr	Static PE information: No import functions for PE file found
Source: aeevts.dll.2.dr	Static PE information: No import functions for PE file found
Source: MpAsDesc.dll.10.dr	Static PE information: No import functions for PE file found
Source: MpEvMsg.dll.10.dr	Static PE information: No import functions for PE file found
Source: MsMpLics.dll.10.dr	Static PE information: No import functions for PE file found

Source: 0039284903284902840932890840928091#U00aaharder.exe, 00000001.00000003.1677493325.0000000001881000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUpdate.exe2 vs 0039284903284902840932890840928091#U00aaharder.exe
Source: 0039284903284902840932890840928091#U00aaharder.exe, 00000001.00000003.1677493325.000000000188F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUpdate.exe2 vs 0039284903284902840932890840928091#U00aaharder.exe
Source: 0039284903284902840932890840928091#U00aaharder.exe	Binary or memory string: OriginalFilenameSetup.exeB vs 0039284903284902840932890840928091#U00aaharder.exe

Source: 0039284903284902840932890840928091#U00aaharder.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: aeevts.dll.2.dr

Static PE information: Section .rsrc

Source: MpDetours.dll.10.dr

Binary string: C>_.\\.\\\?\UNC\\\?\\Device\Mup\\\

Source: classification engine

Classification label: mal72.rans.troj.evad.winEXE@19/109@0/1

Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe

File created: C:\Program Files\Statistical Flexibility

Jump to behavior

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

File created: C:\Users\user\AppData\Local\TreatmentsSecure

Jump to behavior

Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7388:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6372:120:WilError_03

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

File created: C:\Users\user\AppData\Local\Temp\.squirrel-lock-7AF78CD06F3A0347B97EC49DA9489AB48CA7E52D

Jump to behavior

Source: 0039284903284902840932890840928091#U00aaharder.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 0039284903284902840932890840928091#U00aaharder.exe	String found in binary or memory: DeploymentTool.exe\need dictionaryinvalid literal/length codeinvalid distance codeinvalid block typeinvalid stored block lengthstoo many length or distance symbolsinvalid bit length repeatoversubscribed dynamic bit lengths treeincomplete dynamic bit lengths treeoversubscribed literal/length treeincomplete literal/length treeoversubscribed distance treeincomplete distance treeempty distance tree with lengthsunknown compression methodinvalid window sizeincorrect header checkincorrect data check\..\\..//..//..\UT%s%s%s%s%sOpen Setup LogCloseInstallation has failedSquirrelSQUIRREL_TEMP%s%s\%sUnable to write to %s - IT policies may be restricting access to this folder\SquirrelTemp%s\SquirrelSetup.logDATAUpdate.exe"%s" --install . %sThere was an error while installing the application. Check the setup log for more information and contact the author.Failed to extract installervector<T> too longi
Source: Update.exe	String found in binary or memory: b=\|baseUrl={Provides a base URL to prefix the RELEASES file packages with-a=\|process-start-args=iArguments that will be used when starting executable-l=\|shortcut-locations=
Source: Update.exe	String found in binary or memory: ((?=^[ ]{{0,{0}}}[^ \t\n])\|\Z) # Lookahead for non-space at line-start, or end of doc
Source: Update.exe	String found in binary or memory: onError%Downloading file: 1Failed downloading URL: #Downloading url: 1Failed to download url: !squirrel-install3Starting automatic update7Failed to check for updates5Failed to download updates/Failed to apply updates9Failed to set up uninstaller){0} {1}{2} {3} # {4}
Source: Update.exe	String found in binary or memory: Scanning {0}mIgnoring {0} as the target framework is not compatible%Writing {0} to {1}UCouldn't find file for package in {1}: {0}%--squirrel-install%--squirrel-updated'--squirrel-obsolete)--squirrel-uninstall'--squirrel-firstrunAFailed to handle Squirrel events[\StringFileInfo\040904B0\SquirrelAwareVersion)SquirrelAwareVersion;Failed to promote Tray icon:
Source: Update.exe	String found in binary or memory: ..\Update.exegUpdate.exe not found, not a Squirrel-installed app?
Source: Update.exe	String found in binary or memory: update.MNo release to install, running the appIFailed to install package to app dirIFailed to update local releases file;Failed to invoke post-install;Starting fixPinnedExecutables)Fixing up tray icons
Source: Update.exe	String found in binary or memory: -delta.nupkg$iCannot apply combinations of delta and full packagesQCouldn't run Squirrel hook, continuing: ---squirrel-updated {0}---squirrel-install {0}9Squirrel Enabled Apps: [{0}]wNo apps are marked as Squirrel-aware! Going to run them all-Failed to delete key: /--squirrel-obsolete {0}7Couldn't delete directory: QCoudln't run Squirrel hook, continuing: WcleanDeadVersions: checking for version {0}kcleanDeadVersions: exclude current version folder {0}ccleanDeadVersions: exclude new version folder {0}

Source: unknown	Process created: C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe "C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe"
Source: unknown	Process created: C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe "C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe" --rerunningWithoutUAC
Source: C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe	Process created: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe "C:\Users\user\AppData\Local\SquirrelTemp\Update.exe" --install . --rerunningWithoutUAC
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe "C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe" --squirrel-firstrun
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C cd "C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0" & start Treatments?Secure.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe Treatments?Secure.exe
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C sc create MainSVCLine binPath= "C:\Program Files\Statistical Flexibility\MpDefenderCoreService.exe" start= auto & shutdown -r -t 0 -f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc create MainSVCLine binPath= "C:\Program Files\Statistical Flexibility\MpDefenderCoreService.exe" start= auto
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\shutdown.exe shutdown -r -t 0 -f
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe	Process created: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe "C:\Users\user\AppData\Local\SquirrelTemp\Update.exe" --install . --rerunningWithoutUAC	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe "C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe" --squirrel-firstrun	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe Treatments?Secure.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C sc create MainSVCLine binPath= "C:\Program Files\Statistical Flexibility\MpDefenderCoreService.exe" start= auto & shutdown -r -t 0 -f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc create MainSVCLine binPath= "C:\Program Files\Statistical Flexibility\MpDefenderCoreService.exe" start= auto	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\shutdown.exe shutdown -r -t 0 -f	Jump to behavior

Source: C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: msctfui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\shutdown.exe	Section loaded: shutdownext.dll
Source: C:\Windows\System32\shutdown.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll

Source: C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32

Jump to behavior

Source: CoffeeContact.lnk.2.dr	LNK file: ..\..\..\..\..\..\Local\TreatmentsSecure\TreatmentsSecure.exe
Source: CoffeeContact.lnk0.2.dr	LNK file: ..\AppData\Local\TreatmentsSecure\TreatmentsSecure.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\part1.zip	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Main.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\part1.zip.bin	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\ThirdPartyNotices.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\com.microsoft.defender.be.chrome.json	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\com.microsoft.defender.be.firefox.json	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Microsoft-Antimalware-AMFilter.man	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Microsoft-Antimalware-NIS.man	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Microsoft-Antimalware-Protection.man	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Microsoft-Antimalware-RTP.man	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Microsoft-Antimalware-Service.man	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Microsoft-Windows-Windows Defender.man	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\mpextms.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MsMpEng.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\ProtectionManagement.mof	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\ProtectionManagement_Uninstall.mof	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\ConfigSecurityPolicy.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpCmdRun.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpCopyAccelerator.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpDefenderCoreService.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpDlpCmd.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpDlpService.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpSenseComm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpUpdate.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpUxAgent.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MsMpLics.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\ProtectionManagement.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\DefenderCSP.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpAsDesc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpCommu.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpDetours.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpDetoursCopyAccelerator.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpEvMsg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpOAV.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\pack01.zip	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\dllhost2.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\en-EN	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\en-EN\MpClient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\en-EN\MpDlpCmd.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\pt-BR	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\pt-BR\MpAsDesc.dll.mui	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\pt-BR\MpClient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\pt-BR\MpDlpCmd2.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\pt-BR\MpEvMsg.dll.mui	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\pt-BR\mpuxagent.dll.mui	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\pt-BR\ProtectionManagement.dll.mui	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Catalogs	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Catalogs\IGD.CAT	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Drivers	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Drivers\WdBoot.sys	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Drivers\WdDevFlt.sys	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Drivers\WdFilter.sys	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Drivers\WdNisDrv.sys	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Powershell	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Powershell\Defender.psd1	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Powershell\DefenderPerformance.psd1	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpComputerStatus.cdxml	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpPerformanceRecording.psm1	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpPerformanceRecording.wprp	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpPerformanceReport.Format.ps1xml	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpPreference.cdxml	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpRollback.cdxml	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpScan.cdxml	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpSignature.cdxml	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpThreat.cdxml	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpThreatCatalog.cdxml	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpThreatDetection.cdxml	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpWDOScan.cdxml	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpClient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\Statistical Flexibility\MpDefenderCoreService.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Directory created: C:\Program Files\BlanketFolding	Jump to behavior

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TreatmentsSecure

Jump to behavior

Source: 0039284903284902840932890840928091#U00aaharder.exe

Static file information: File size 18312192 > 1048576

Source: 0039284903284902840932890840928091#U00aaharder.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x114be00

Source: 0039284903284902840932890840928091#U00aaharder.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 0039284903284902840932890840928091#U00aaharder.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 0039284903284902840932890840928091#U00aaharder.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 0039284903284902840932890840928091#U00aaharder.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 0039284903284902840932890840928091#U00aaharder.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 0039284903284902840932890840928091#U00aaharder.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 0039284903284902840932890840928091#U00aaharder.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: 0039284903284902840932890840928091#U00aaharder.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\vcomp140d.i386.pdbGCTL source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: NisSrv.pdb source: dllhost2.exe.10.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\vcamp140.i386.pdbGCTL source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: netstandard.pdb.mdb source: Update.exe
Source:	Binary string: VaultRoaming.pdbUGP source: VaultRoaming.dll.2.dr
Source:	Binary string: WdBoot.pdb source: Treatments?Secure.exe, 0000000A.00000002.2921626182.0000024FA4072000.00000004.00000800.00020000.00000000.sdmp, Treatments?Secure.exe, 0000000A.00000002.2921626182.0000024FA4035000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: Update.exe, 00000002.00000002.1733253754.0000000002A8A000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\DeveloperSys\Documents\Embarcadero\Studio\Projects\DLL New Completa\Projeto C++\NewHorizon\x64\Release\NewHorizon.pdb source: Treatments?Secure.exe, 0000000A.00000002.2921626182.0000024FA3CB5000.00000004.00000800.00020000.00000000.sdmp, MpClient.dll0.10.dr
Source:	Binary string: vcamp120.i386.pdb source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140d.amd64.pdb/// source: Update.exe, 00000002.00000002.1733253754.0000000002A8A000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002A63000.00000004.00000800.00020000.00000000.sdmp, vcruntime140d.dll.2.dr
Source:	Binary string: MpSenseComm.pdbGCTL source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CA95000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\vcamp140.i386.pdb source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: vcamp120.i386.pdb8P source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: MpDetours.pdbGCTL source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8C992000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr, MpDetours.dll.10.dr
Source:	Binary string: slpts.pdb source: Update.exe, 00000002.00000002.1733253754.0000000002929000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002950000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: MpUxAgent.pdb source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: MpCommu.pdbGCTL source: MpCommu.dll.10.dr
Source:	Binary string: shellext.pdbOGPS source: shellext.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\vcomp140.i386.pdb source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: MpUxAgent.pdbGCTL source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: WdNisDrv.pdb source: Treatments?Secure.exe, 0000000A.00000002.2921626182.0000024FA4105000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: MsMpEng.pdbGCTL source: MsMpEng.exe.10.dr
Source:	Binary string: SmartcardCredentialProvider.pdb source: SmartcardCredentialProvider.dll.2.dr
Source:	Binary string: VaultRoaming.pdb source: VaultRoaming.dll.2.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: Update.exe, 00000002.00000002.1733253754.0000000002A63000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002A3D000.00000004.00000800.00020000.00000000.sdmp, vcruntime140.dll.2.dr
Source:	Binary string: PhotoViewer.pdb source: PhotoViewer.dll.2.dr
Source:	Binary string: vccorlib120.i386.pdb source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: slpts.pdbL source: Update.exe, 00000002.00000002.1733253754.0000000002929000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002950000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\vcomp140d.i386.pdb source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140d.amd64.pdb source: Update.exe, 00000002.00000002.1733253754.0000000002A8A000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002A63000.00000004.00000800.00020000.00000000.sdmp, vcruntime140d.dll.2.dr
Source:	Binary string: MpUpdate.pdbGCTL source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: MpOAV.pdb source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CA95000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: MpOAV.pdbGCTL source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CA95000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: C:\Users\ani\code\squirrel\squirrel.windows\build\Release\Win32\StubExecutable.pdb source: Update.exe, 00000002.00000002.1733253754.0000000002A16000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.00000000029EB000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\vcomp140.i386.pdbGCTL source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: MpDetoursCopyAccelerator.pdb source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CA79000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: vccorlib120.i386.pdb0 source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1d.amd64.pdb source: Update.exe, 00000002.00000002.1733253754.0000000002AD7000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: DefenderCSP.pdb source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8C992000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: shellext.pdb source: shellext.dll.2.dr
Source:	Binary string: vcomp120.i386.pdb0' source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: WdNisDrv.pdbGCTL source: Treatments?Secure.exe, 0000000A.00000002.2921626182.0000024FA4105000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: PhotoViewer.pdb@WH source: PhotoViewer.dll.2.dr
Source:	Binary string: MpDlpCmd.pdbGCTL source: MpDlpCmd2.exe.10.dr
Source:	Binary string: version.pdb source: Update.exe, 00000002.00000002.1733253754.0000000002B24000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002AFD000.00000004.00000800.00020000.00000000.sdmp, version.dll.2.dr
Source:	Binary string: C:\Users\ani\code\squirrel\squirrel.windows\build\Release\Win32\Setup.pdb source: 0039284903284902840932890840928091#U00aaharder.exe
Source:	Binary string: MpDetours.pdb source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8C992000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr, MpDetours.dll.10.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\vccorlib140.i386.pdb source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: SLWGA.pdb source: Update.exe, 00000002.00000002.1733253754.000000000295C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: vcomp120.i386.pdb source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: MpSenseComm.pdb source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CA95000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: MpCommu.pdb source: MpCommu.dll.10.dr
Source:	Binary string: MpDetoursCopyAccelerator.pdbGCTL source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CA79000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dllb.pdb source: Treatments?Secure.exe, 00000003.00000002.1754544140.000002CB8D02D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WdBoot.pdbGCTL source: Treatments?Secure.exe, 0000000A.00000002.2921626182.0000024FA4072000.00000004.00000800.00020000.00000000.sdmp, Treatments?Secure.exe, 0000000A.00000002.2921626182.0000024FA4035000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: NisSrv.pdbGCTL source: dllhost2.exe.10.dr
Source:	Binary string: MpDlpCmd.pdb source: MpDlpCmd2.exe.10.dr
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1d.amd64.pdb""" source: Update.exe, 00000002.00000002.1733253754.0000000002AD7000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002AB1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: MsMpEng.pdb source: MsMpEng.exe.10.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.pdb source: Treatments?Secure.exe, 00000003.00000002.1761057385.000002CBA92BD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: MpUpdate.pdb source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: SLWGA.pdbH source: Update.exe, 00000002.00000002.1733253754.000000000295C000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\vccorlib140.i386.pdbGCTL source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CC14000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr
Source:	Binary string: C:\Users\DeveloperSys\Documents\Embarcadero\Studio\Projects\DLL New Completa\Projeto C++\ScreenTake\x64\Release\ScreenTake.pdb source: Treatments?Secure.exe, 0000000A.00000002.2921626182.0000024FA3CB5000.00000004.00000800.00020000.00000000.sdmp, MpDefenderCoreService.dll.10.dr
Source:	Binary string: DefenderCSP.pdbGCTL source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8C992000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr

Source: 0039284903284902840932890840928091#U00aaharder.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 0039284903284902840932890840928091#U00aaharder.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 0039284903284902840932890840928091#U00aaharder.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 0039284903284902840932890840928091#U00aaharder.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 0039284903284902840932890840928091#U00aaharder.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: MpDetoursCopyAccelerator.dll.2.dr

Static PE information: 0xEF4C0A52 [Thu Mar 21 21:00:02 2097 UTC]

Source: PhotoAcq.dll.2.dr	Static PE information: section name: .orpc
Source: PhotoViewer.dll.2.dr	Static PE information: section name: .didat
Source: aelupsvc.dll.2.dr	Static PE information: section name: .didat
Source: SmartcardCredentialProvider.dll.2.dr	Static PE information: section name: .didat
Source: SmartCardSimulator.dll.2.dr	Static PE information: section name: .orpc
Source: vcruntime140.dll.2.dr	Static PE information: section name: _RDATA
Source: vcruntime140d.dll.2.dr	Static PE information: section name: _RDATA
Source: WdDevFlt.sys.10.dr	Static PE information: section name: fothk
Source: WdDevFlt.sys.10.dr	Static PE information: section name: GFIDS
Source: WdFilter.sys.10.dr	Static PE information: section name: fothk
Source: WdFilter.sys.10.dr	Static PE information: section name: GFIDS
Source: WdNisDrv.sys.10.dr	Static PE information: section name: fothk
Source: WdNisDrv.sys.10.dr	Static PE information: section name: GFIDS
Source: MpCmdRun.exe.10.dr	Static PE information: section name: .didat
Source: ProtectionManagement.dll.10.dr	Static PE information: section name: .didat
Source: MpCommu.dll.10.dr	Static PE information: section name: .didat
Source: MpDetours.dll.10.dr	Static PE information: section name: .detourc
Source: MpDetours.dll.10.dr	Static PE information: section name: .detourd
Source: MpDetoursCopyAccelerator.dll.10.dr	Static PE information: section name: .detourc
Source: MpDetoursCopyAccelerator.dll.10.dr	Static PE information: section name: .detourd
Source: MpClient.dll.10.dr	Static PE information: section name: .didata
Source: MpClient.dll0.10.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 2_2_00007FFD9B79D2A5 pushad ; iretd	2_2_00007FFD9B79D2A6
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Code function: 3_2_00007FFD9B892549 push ebx; ret	3_2_00007FFD9B89255A
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Code function: 10_2_00007FFD9B8A6B38 push E95E509Eh; ret	10_2_00007FFD9B8A6B49
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Code function: 10_2_00007FFD9B8A2549 push ebx; ret	10_2_00007FFD9B8A255A

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\Drivers\WdBoot.sys	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\Drivers\WdDevFlt.sys	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\Drivers\WdFilter.sys	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\Drivers\WdNisDrv.sys	Jump to behavior

Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\MpDetours.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\vcruntime140_1d.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\vcruntime140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\MpDefenderCoreService.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\dllhost2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\pt-BR\MpDlpCmd2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\MpUpdate.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\DefenderCSP.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\PhotoBase.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\PhotoAcq.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\aeinv.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\aelupsvc.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\MpDlpCmd.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\en-EN\MpClient.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\MpCopyAccelerator.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\shellext.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\ProtectionManagement.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\pt-BR\mpuxagent.dll.mui	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\MpOAV.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\MpDlpService.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\MsMpLics.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\verifier.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\pt-BR\MpEvMsg.dll.mui	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\MpUxAgent.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\pt-BR\MpAsDesc.dll.mui	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\MsMpEng.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\ConfigSecurityPolicy.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\MpCmdRun.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\Drivers\WdDevFlt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\mpextms.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\SmartCardSimulator.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\VaultRoaming.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\pt-BR\ProtectionManagement.dll.mui	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\MpOAV.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\version.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\Drivers\WdFilter.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\SmartcardCredentialProvider.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\slpts.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\MpDetoursCopyAccelerator.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\ImagingEngine.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\AMMonitoringProvider.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\Drivers\WdBoot.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\MpSenseComm.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\pt-BR\MpClient.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\aepdu.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\aeevts.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\TreatmentsSecure\Update.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\Drivers\WdNisDrv.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\slwga.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\TreatmentsSecure\Treatments?Secure.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\MpDefenderCoreService.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\vcruntime140d.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\PhotoViewer.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\MpAsDesc.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\MpClient.dll	Jump to dropped file
Source: C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe	File created: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\MpCommu.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\en-EN\MpDlpCmd.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	File created: C:\Program Files\Statistical Flexibility\MpEvMsg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\MpDetoursCopyAccelerator.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

File created: C:\Users\user\AppData\Local\SquirrelTemp\Squirrel-Install.log

Jump to behavior

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

File created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Readme.txt

Jump to behavior

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TreatmentsSecure			Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TreatmentsSecure\CoffeeContact.lnk			Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc create MainSVCLine binPath= "C:\Program Files\Statistical Flexibility\MpDefenderCoreService.exe" start= auto

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Memory allocated: A30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Memory allocated: 1A640000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Memory allocated: 2CB8D1B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Memory allocated: 2CBA6CA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Memory allocated: 24FA2120000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Memory allocated: 24FBBB10000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Window / User API: threadDelayed 2166			Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Window / User API: threadDelayed 1240			Jump to behavior

Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\MpDetours.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\vcruntime140_1d.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\pt-BR\MpDlpCmd2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\vcruntime140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\dllhost2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\MpDefenderCoreService.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\MpUpdate.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\DefenderCSP.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\PhotoBase.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\PhotoAcq.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\aeinv.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\aelupsvc.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\MpDlpCmd.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\en-EN\MpClient.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\MpCopyAccelerator.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\shellext.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\ProtectionManagement.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\pt-BR\mpuxagent.dll.mui	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\MpOAV.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\MpDlpService.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\MsMpLics.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\pt-BR\MpEvMsg.dll.mui	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\verifier.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\MpUxAgent.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\pt-BR\MpAsDesc.dll.mui	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\MsMpEng.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\ConfigSecurityPolicy.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\MpCmdRun.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\mpextms.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\Drivers\WdDevFlt.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\pt-BR\ProtectionManagement.dll.mui	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\SmartCardSimulator.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\VaultRoaming.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\MpOAV.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\Drivers\WdFilter.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\SmartcardCredentialProvider.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\slpts.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\MpDetoursCopyAccelerator.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\ImagingEngine.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\Drivers\WdBoot.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\AMMonitoringProvider.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\MpSenseComm.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\pt-BR\MpClient.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\Drivers\WdNisDrv.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\aepdu.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\aeevts.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\TreatmentsSecure\Treatments?Secure.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\slwga.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\MpDefenderCoreService.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\vcruntime140d.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\PhotoViewer.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\MpAsDesc.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\MpClient.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\MpCommu.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\en-EN\MpDlpCmd.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Dropped PE file which has not been started: C:\Program Files\Statistical Flexibility\MpEvMsg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\MpDetoursCopyAccelerator.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe TID: 5064	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe TID: 3992	Thread sleep count: 2166 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe TID: 3992	Thread sleep count: 1240 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe TID: 6600	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe TID: 5740	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6208	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe

Code function: 0_2_00169ED6 VirtualQuery,GetSystemInfo,

0_2_00169ED6

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\TreatmentsSecure\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\	Jump to behavior

Source: Treatments?Secure.exe, 00000003.00000002.1761057385.000002CBA92BD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: GetType4f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}!
Source: Treatments?Secure.exe, 0000000A.00000002.2927672891.0000024FBD812000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}.
Source: Treatments?Secure.exe.2.dr	Binary or memory string: {O'NULLkernel32.dllMicrosoft HvVMwareVMware
Source: Treatments?Secure.exe.2.dr	Binary or memory string: VMwareVMware
Source: svchost.exe, 00000005.00000002.2920378466.000001DFC8A2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000005.00000002.2921586596.000001DFCE056000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8C992000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr	Binary or memory string: DefenderDetectionsNameURLSeverityCategoryCurrentStatusExecutionStatusInitialDetectionTimeLastThreatStatusChangeTimeNumberOfDetectionsHealthProductStatusComputerStateDefenderEnabledRtpEnabledNisEnabledQuickScanOverdueFullScanOverdueSignatureOutOfDateRebootRequiredFullScanRequiredEngineVersionSignatureVersionDefenderVersionQuickScanTimeFullScanTimeQuickScanSigVersionFullScanSigVersionTamperProtectionEnabledIsVirtualMachineDeviceControlStateConfigurationThrottleAccessEventsPolicyGroupsGroupDataPolicyRulesRuleDataTamperProtectionEnableFileHashComputationMeteredConnectionUpdatesSupportLogLocationExcludedIpAddressesAllowNetworkProtectionOnWinServerDisableCpuThrottleOnIdleScansDisableLocalAdminMergeSchedulerRandomizationTimeDisableTlsParsingDisableHttpParsingDisableDnsParsingDisableDnsOverTcpParsingDisableSshParsingPlatformUpdatesChannelEngineUpdatesChannelSecurityIntelligenceUpdatesChannelDisableGradualReleaseAllowNetworkProtectionDownLevelEnableDnsSinkholeDisableInboundConnectionFilteringDisableRdpParsingAllowDatagramProcessingOnWinServerDisableDatagramProcessingEnableConvertWarnToBlockDisableNetworkProtectionPerfTelemetryHideExclusionsFromLocalAdminsThrottleForScheduledScanOnlyDaysUntilAggressiveCatchupQuickScanASROnlyPerRuleExclusionsDataDuplicationDirectoryDataDuplicationRemoteLocationDisableFtpParsingDeviceControlEnabledDefaultEnforcementAllowSwitchToAsyncInspectionPassiveRemediationDisableCoreServiceECSIntegrationDisableCoreServiceTelemetryDataDuplicationLocalRetentionPeriodIntelTDTEnabledDisableSmtpParsingDisableQuicParsingNetworkProtectionReputationModeEnableUdpSegmentationOffloadEnableUdpReceiveOffloadEnableEcsConfigurationRandomizeScheduleTaskTimesArchiveMaxSizeArchiveMaxDepthScanOnlyIfIdleEnabledSecuredDevicesConfigurationHideExclusionsFromLocalUsersOobeEnableRtpAndSigUpdatePerformanceModeStatusDataDuplicationMaximumQuotaDisableCacheMaintenanceSecurityIntelligenceLocationUpdateAtScheduledTimeOnlyQuickScanIncludeExclusionsScheduleSecurityIntelligenceUpdateTimeScheduleSecurityIntelligenceUpdateDayBehavioralNetworkBlocksRemoteEncryptionProtectionRemoteEncryptionProtectionConfiguredStateRemoteEncryptionProtectionMaxBlockTimeRemoteEncryptionProtectionAggressivenessRemoteEncryptionProtectionExclusionsBruteForceProtectionBruteForceProtectionConfiguredStateBruteForceProtectionMaxBlockTimeBruteForceProtectionAggressivenessBruteForceProtectionExclusionsBruteForceProtectionPluginsBruteForceProtectionLocalNetworkBlockingBruteForceProtectionSkipLearningPeriodScanUpdateSignatureOfflineScanRollbackPlatformRollbackEngineNULL!.

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Drops or copies MsMpEng.exe (Windows Defender, likely to bypass HIPS)

Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe

File created: C:\Program Files\Statistical Flexibility\MsMpEng.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe "C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe" --squirrel-firstrun	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe Treatments?Secure.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C sc create MainSVCLine binPath= "C:\Program Files\Statistical Flexibility\MpDefenderCoreService.exe" start= auto & shutdown -r -t 0 -f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc create MainSVCLine binPath= "C:\Program Files\Statistical Flexibility\MpDefenderCoreService.exe" start= auto	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\shutdown.exe shutdown -r -t 0 -f	Jump to behavior

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Queries volume information: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\v4.0_4.0.0.0__31bf3856ad364e35\System.ComponentModel.DataAnnotations.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.DataSetExtensions\v4.0_4.0.0.0__b77a5c561934e089\System.Data.DataSetExtensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.DataSetExtensions\v4.0_4.0.0.0__b77a5c561934e089\System.Data.DataSetExtensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe

Code function: 0_2_0016B06B GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_0016B06B

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Treatments?Secure.exe, 0000000A.00000002.2921626182.0000024FA3B11000.00000004.00000800.00020000.00000000.sdmp, part1.zip.bin.10.dr

Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	12 Windows Service	12 Windows Service	13 Masquerading	1 Network Sniffing	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Service Execution	1 Registry Run Keys / Startup Folder	11 Process Injection	11 Disable or Modify Tools	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	41 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	11 Process Injection	NTDS	41 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 Network Sniffing	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	24 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
0039284903284902840932890840928091#U00aaharder.exe	6%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files\Statistical Flexibility\MpClient.dll	100%	Joe Sandbox ML
C:\Program Files\Statistical Flexibility\ConfigSecurityPolicy.exe	0%	ReversingLabs
C:\Program Files\Statistical Flexibility\DefenderCSP.dll	0%	ReversingLabs
C:\Program Files\Statistical Flexibility\Drivers\WdBoot.sys	0%	ReversingLabs
C:\Program Files\Statistical Flexibility\Drivers\WdDevFlt.sys	0%	ReversingLabs
C:\Program Files\Statistical Flexibility\Drivers\WdFilter.sys	0%	ReversingLabs
C:\Program Files\Statistical Flexibility\Drivers\WdNisDrv.sys	0%	ReversingLabs
C:\Program Files\Statistical Flexibility\MpAsDesc.dll	0%	ReversingLabs
C:\Program Files\Statistical Flexibility\MpClient.dll	21%	ReversingLabs
C:\Program Files\Statistical Flexibility\MpCmdRun.exe	0%	ReversingLabs
C:\Program Files\Statistical Flexibility\MpCommu.dll	0%	ReversingLabs
C:\Program Files\Statistical Flexibility\MpCopyAccelerator.exe	0%	ReversingLabs
C:\Program Files\Statistical Flexibility\MpDefenderCoreService.dll	26%	ReversingLabs	Win32.Trojan.Generic
C:\Program Files\Statistical Flexibility\MpDefenderCoreService.exe	0%	ReversingLabs
C:\Program Files\Statistical Flexibility\MpDetours.dll	0%	ReversingLabs
C:\Program Files\Statistical Flexibility\MpDetoursCopyAccelerator.dll	0%	ReversingLabs
C:\Program Files\Statistical Flexibility\MpDlpCmd.exe	0%	ReversingLabs
C:\Program Files\Statistical Flexibility\MpDlpService.exe	0%	ReversingLabs
C:\Program Files\Statistical Flexibility\MpEvMsg.dll	0%	ReversingLabs
C:\Program Files\Statistical Flexibility\MpOAV.dll	0%	ReversingLabs
C:\Program Files\Statistical Flexibility\MpSenseComm.dll	0%	ReversingLabs
C:\Program Files\Statistical Flexibility\MpUpdate.dll	0%	ReversingLabs
C:\Program Files\Statistical Flexibility\MpUxAgent.dll	0%	ReversingLabs
C:\Program Files\Statistical Flexibility\MsMpEng.exe	0%	ReversingLabs
C:\Program Files\Statistical Flexibility\MsMpLics.dll	0%	ReversingLabs
C:\Program Files\Statistical Flexibility\ProtectionManagement.dll	0%	ReversingLabs
C:\Program Files\Statistical Flexibility\dllhost2.exe	0%	ReversingLabs
C:\Program Files\Statistical Flexibility\en-EN\MpDlpCmd.exe	0%	ReversingLabs
C:\Program Files\Statistical Flexibility\mpextms.exe	0%	ReversingLabs
C:\Program Files\Statistical Flexibility\pt-BR\MpAsDesc.dll.mui	0%	ReversingLabs
C:\Program Files\Statistical Flexibility\pt-BR\MpClient.dll	39%	ReversingLabs	Win64.Trojan.Generic
C:\Program Files\Statistical Flexibility\pt-BR\MpDlpCmd2.exe	0%	ReversingLabs
C:\Program Files\Statistical Flexibility\pt-BR\MpEvMsg.dll.mui	0%	ReversingLabs
C:\Program Files\Statistical Flexibility\pt-BR\ProtectionManagement.dll.mui	0%	ReversingLabs
C:\Program Files\Statistical Flexibility\pt-BR\mpuxagent.dll.mui	0%	ReversingLabs
C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\TreatmentsSecure\Treatments?Secure.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\TreatmentsSecure\Update.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\AMMonitoringProvider.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\ImagingEngine.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\MpDetoursCopyAccelerator.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\MpOAV.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\PhotoAcq.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\PhotoBase.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\PhotoViewer.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\SmartCardSimulator.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\SmartcardCredentialProvider.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe	13%	ReversingLabs
C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\VaultRoaming.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\aeevts.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\aeinv.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\aelupsvc.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\aepdu.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\shellext.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\slpts.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\slwga.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\vcruntime140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\vcruntime140_1d.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\vcruntime140d.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\verifier.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\version.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
https://g.live.com/odclientsettings/ProdV2.C:	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
https://g.live.com/odclientsettings/Prod.C:	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
https://g.live.com/odclientsettings/ProdV2	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	0%	URL Reputation	safe
http://www.fontbureau.com	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
https://github.com/myuser/myrepo	0%	Avira URL Cloud	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
http://defaultcontainer/lib/net48/Treatments?Secure.exe	0%	Avira URL Cloud	safe
http://defaultcontainer/tempfiles/sample.bsdiff	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net48/AMMonitoringProvider.dll	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net48/verifier.dll	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net48/MpOAV.dll	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net48/aelupsvc.dllz	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net48/MpDetoursCopyAccelerator.dll	0%	Avira URL Cloud	safe
https://github.com/myuser/myrepo	0%	Virustotal		Browse
http://defaultcontainer/package/services/metadata/core-properties/1fd1c4030bbc455c86f64fbcf96402fa.p	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net48/ImagingEngine.dll	0%	Avira URL Cloud	safe
http://defaultcontainer/TreatmentsSecure.nuspecz	0%	Avira URL Cloud	safe
http://defaultcontainer/tempfiles/sample.nuspec	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net48/PhotoBase.dll	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net48/SmartcardCredentialProvider.dll	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net48/PhotoAcq.dll	0%	Avira URL Cloud	safe
http://defaultcontainer/tempfiles/sample.exe	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net48/slpts.dll	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net48/aeevts.dll	0%	Avira URL Cloud	safe
http://canonicalizer.ucsuri.tcs/68007400740070003a002f002f00httpsftp://map/set	0%	Avira URL Cloud	safe
http://defaultcontainer/tempfiles/sample.txt	0%	Avira URL Cloud	safe
http://defaultcontainer/tempfiles/sample.dll	0%	Avira URL Cloud	safe
http://defaultcontainer/tempfiles/sample.rels	0%	Avira URL Cloud	safe
http://www.validationtest.contoso.com/test%ld.htmlMpOAV_ForceDeepScan	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net48/aelupsvc.dll	0%	Avira URL Cloud	safe
http://defaultcontainer/tempfiles/sample.shasum	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net48/vcruntime140_1.dll	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net48/aeinv.dll	0%	Avira URL Cloud	safe
http://schemas.openxmlformats.or	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net48/Treatments?Secure_ExecutionStub.exe	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net48/version.dll	0%	Avira URL Cloud	safe
http://defaultcontainer/TreatmentsSecure.nuspec	0%	Avira URL Cloud	safe
http://www.validationtest.contoso.com/test%ld.htmlMpOAV_ForceDeepScan	0%	Virustotal		Browse
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICENSE-2.0	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net48/vcruntime140.dll	0%	Avira URL Cloud	safe
http://defaultcontainer/tempfiles/sample.cab	0%	Avira URL Cloud	safe
http://defaultcontainer/tempfiles/sample.diff	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net48/Treatments?Secure.exez	0%	Avira URL Cloud	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest	0%	Virustotal		Browse
http://crl.ver)	0%	Avira URL Cloud	safe
https://api.github.com/#	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICENSE-2.0	0%	Virustotal		Browse
http://defaultcontainer/lib/net48/vcruntime140_1d.dll	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net48/slpts.dllz	0%	Avira URL Cloud	safe
http://tempuri.org/schoolDataSet.xsd	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net48/Readme.txt	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net48/PhotoViewer.dll	0%	Avira URL Cloud	safe
http://defaultcontainer/_rels/.rels	0%	Avira URL Cloud	safe
https://api.github.com/#	0%	Virustotal		Browse
http://defaultcontainer/lib/net48/vcruntime140d.dll	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net48/slwga.dll	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net48/SmartCardSimulator.dll	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net48/aepdu.dll	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net48/VaultRoaming.dll	0%	Avira URL Cloud	safe
http://defaultcontainer/tempfiles/sample.psmdcp	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net48/part1.cab	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net48/shellext.dll	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://defaultcontainer/lib/net48/verifier.dll	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/myuser/myrepo	Update.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://defaultcontainer/tempfiles/sample.bsdiff	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net48/AMMonitoringProvider.dll	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net48/Treatments?Secure.exe	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designersG	Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://defaultcontainer/lib/net48/MpOAV.dll	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/?	Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://defaultcontainer/lib/net48/aelupsvc.dllz	Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/bThe	Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://defaultcontainer/lib/net48/MpDetoursCopyAccelerator.dll	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/package/services/metadata/core-properties/1fd1c4030bbc455c86f64fbcf96402fa.p	Update.exe, 00000002.00000002.1733253754.0000000002BBC000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002757000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://defaultcontainer/lib/net48/ImagingEngine.dll	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/TreatmentsSecure.nuspecz	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/tempfiles/sample.nuspec	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net48/PhotoBase.dll	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.5.dr	false	URL Reputation: safe	unknown
http://defaultcontainer/lib/net48/SmartcardCredentialProvider.dll	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://defaultcontainer/lib/net48/PhotoAcq.dll	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.goodfont.co.kr	Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://defaultcontainer/tempfiles/sample.exe	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://canonicalizer.ucsuri.tcs/68007400740070003a002f002f00httpsftp://map/set	dllhost2.exe.10.dr	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com	Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://g.live.com/odclientsettings/Prod.C:	edb.log.5.dr	false	URL Reputation: safe	unknown
http://defaultcontainer/lib/net48/aeevts.dll	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/cThe	Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://g.live.com/odclientsettings/ProdV2	edb.log.5.dr	false	URL Reputation: safe	unknown
http://defaultcontainer/lib/net48/slpts.dll	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/tempfiles/sample.txt	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/tempfiles/sample.dll	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/tempfiles/sample.rels	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.validationtest.contoso.com/test%ld.htmlMpOAV_ForceDeepScan	Treatments?Secure.exe, 00000003.00000000.1714161486.000002CB8CA95000.00000002.00000001.01000000.00000008.sdmp, Treatments?Secure.exe.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net48/aelupsvc.dll	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/tempfiles/sample.shasum	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://defaultcontainer/lib/net48/vcruntime140_1.dll	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net48/aeinv.dll	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	MpCommu.dll.10.dr	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.openxmlformats.or	Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Treatments?Secure.exe, 00000003.00000002.1758368532.000002CB8ECA1000.00000004.00000800.00020000.00000000.sdmp, Treatments?Secure.exe, 0000000A.00000002.2921626182.0000024FA3B11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000005.00000003.1727609289.000001DFCE2C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.5.dr, edb.log.5.dr	false	URL Reputation: safe	unknown
http://defaultcontainer/lib/net48/Treatments?Secure_ExecutionStub.exe	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net48/version.dll	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/TreatmentsSecure.nuspec	Update.exe, 00000002.00000002.1733253754.0000000002BBC000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002757000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest	MpCommu.dll.10.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com	Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://defaultcontainer/lib/net48/vcruntime140.dll	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/tempfiles/sample.cab	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	MpCommu.dll.10.dr	false	URL Reputation: safe	unknown
http://defaultcontainer/tempfiles/sample.diff	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net48/Treatments?Secure.exez	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000005.00000002.2921480958.000001DFCE000000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.github.com/#	Update.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net48/vcruntime140_1d.dll	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net48/slpts.dllz	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/schoolDataSet.xsd	Treatments?Secure.exe, 00000003.00000002.1758368532.000002CB8ECA1000.00000004.00000800.00020000.00000000.sdmp, Treatments?Secure.exe, 0000000A.00000002.2921626182.0000024FA3B11000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net48/Readme.txt	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net48/PhotoViewer.dll	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://defaultcontainer/_rels/.rels	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net48/vcruntime140d.dll	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000005.00000003.1727609289.000001DFCE2C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.5.dr	false	URL Reputation: safe	unknown
http://defaultcontainer/lib/net48/slwga.dll	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://defaultcontainer/lib/net48/SmartCardSimulator.dll	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers8	Treatments?Secure.exe, 00000003.00000002.1759843144.000002CBA87B2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://defaultcontainer/lib/net48/aepdu.dll	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net48/VaultRoaming.dll	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/tempfiles/sample.psmdcp	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net48/part1.cab	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net48/shellext.dll	Update.exe, 00000002.00000002.1733253754.0000000002B8B000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000002.00000002.1733253754.0000000002730000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1501748
Start date and time:	2024-08-30 12:30:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	0039284903284902840932890840928091#U00aaharder.exe renamed because original name is a hash value
Original Sample Name:	0039284903284902840932890840928091harder.exe
Detection:	MAL
Classification:	mal72.rans.troj.evad.winEXE@19/109@0/1
EGA Information:	Successful, ratio: 25%
HCA Information:	Successful, ratio: 57% Number of executed functions: 337 Number of non-executed functions: 11
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, consent.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Treatments?Secure.exe, PID 1456 because it is empty
Execution Graph export aborted for target Treatments?Secure.exe, PID 6612 because it is empty
Execution Graph export aborted for target Update.exe, PID 6544 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:31:06	API Interceptor	2x Sleep call for process: svchost.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files\Statistical Flexibility\ConfigSecurityPolicy.exe	00120948320943020320948329038902202#U00aacharged.exe	Get hash	malicious	Unknown	Browse
	00120948320943020320948329038902202#U00aacharged.exe	Get hash	malicious	Unknown	Browse
	739Op6J6EZ.exe	Get hash	malicious	Unknown	Browse
	9302850943290000921843029032221#U00bafault.exe	Get hash	malicious	Unknown	Browse
	9302850943290000921843029032221#U00bafault.exe	Get hash	malicious	Unknown	Browse
C:\Program Files\Statistical Flexibility\DefenderCSP.dll	00120948320943020320948329038902202#U00aacharged.exe	Get hash	malicious	Unknown	Browse
	00120948320943020320948329038902202#U00aacharged.exe	Get hash	malicious	Unknown	Browse
	739Op6J6EZ.exe	Get hash	malicious	Unknown	Browse
	9302850943290000921843029032221#U00bafault.exe	Get hash	malicious	Unknown	Browse
	9302850943290000921843029032221#U00bafault.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files\Main.txt

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	100
Entropy (8bit):	4.483794256644283
Encrypted:	false
SSDEEP:	3:8VyiHoHaRf2cWJPGEA+uR0IEREaKC5Suf2cWJPGEh:8QiIH+DPiuR05iaZ5SuDPE
MD5:	40449167E31198AD84BC4671A6D88F6E
SHA1:	80B1A770D3E635C8F52D2A66E3A65A44A997BD03
SHA-256:	514B841BF01A606E00B82685EF68FD105B5FC2A2C1AEAC1269E4626A87EAA8DA
SHA-512:	778FA2C30593BB6F3A6A3F46BAD5918B4EA15805FF0D254E872EA5A636C069B1DCB33CEB5298120057CB37868E42987EA5C8D67D326F579B6E9FCBEFD556A2DB
Malicious:	false
Reputation:	low
Preview:	appdata\|\Microsoft\SystemCertificates\|C:\Users\NOMEAQUI\AppData\Roaming\Microsoft\SystemCertificates

C:\Program Files\Statistical Flexibility\Catalogs\IGD.CAT

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	data
Category:	dropped
Size (bytes):	121303
Entropy (8bit):	6.868877978811133
Encrypted:	false
SSDEEP:	1536:MCyIGTNB53e3fEciZZTta3+YWZMfPDztP:MCyIGTNH3e3fEw3+HZkrxP
MD5:	43EFB6C18D3952D62A15C40835918018
SHA1:	516A20CE5638A2AA3E165A5ED823639DDDC28D16
SHA-256:	DD5D984361C0D956260A31C3892CB034C94EC49237637D0931346D4D8950A1CB
SHA-512:	6C0142E37CB61492B0DA762458D9613A6B211E66BBA7927BE94759AF1E0EEACB53B84E6325E85258FE9CE7F0F46D46ED944098260ECCDE752A82D379F211763C
Malicious:	false
Preview:	0.......H...........0......1.0...`.H.e......0......+.....7.......0....0...+.....7.....c......G..{v.'....240312012628Z0...+.....7.....0...h0...6.h..3........S..<.1.0...+.....7...1...0... .s..y..A;l._...w.......m....D.i.1q0...+.....7...1...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .s..y..A;l._...w.......m....D.i.0......2.]'..EPIC{x..1.0...+.....7...1...0... ..9..O.-.8...]Q...P......G..01q0...+.....7...1...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..9..O.-.8...]Q...P......G..00....9q..o.dGP..L..x..1.0...+.....7...1...0....h.N.u...P.~.w...1.0...+.....7...1...0...s~,.Or.LL...rt.eq..1.0...+.....7...1...0... ..:...7.... ..vE.W.N&...b.V.x...1q0...+.....7...1...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..:...7.... ..vE.W.N&...b.V.x...0....nk..b..4..Y.b. ..I1.0...+.....7...1...0... ..RI.%.L...@.p..m.9..+..@)..G.1q0...+.....7...1...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..RI.%.L...@.p..m.9

C:\Program Files\Statistical Flexibility\ConfigSecurityPolicy.exe

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	464280
Entropy (8bit):	6.321152827028335
Encrypted:	false
SSDEEP:	6144:uIZSAYJo3WRdlXOoYCCK1dz+HhL/tmhmjY6CTEEXaQwlSbSse:uIsAYBRdl+oFdkR1AM3CTEGaQwIJ
MD5:	E74FB9C4E1950121F50C2326981687E3
SHA1:	F3B05B20FE3AD9E89EB65F5308BCFE7AFA4600DE
SHA-256:	76B1D718DA599A6BEE5AA5FBD7DFD031022A8331BDAE34267B0D4738CA96F6E4
SHA-512:	B2D010CDDC9C4B4028D292E93142CF502C626D1C93FC8C9DE216940BCF0FF25942B69B784B92C5C71454AA5D7E7FF4F28A6B0099539DCBBEDC1FFCBF01C4C90A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 00120948320943020320948329038902202#U00aacharged.exe, Detection: malicious, Browse Filename: 00120948320943020320948329038902202#U00aacharged.exe, Detection: malicious, Browse Filename: 739Op6J6EZ.exe, Detection: malicious, Browse Filename: 9302850943290000921843029032221#U00bafault.exe, Detection: malicious, Browse Filename: 9302850943290000921843029032221#U00bafault.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........M...M...M...=...L...D.{.u.......l.......B..............P...M......=..."...=...L...=...L...RichM...........PE..d...x@............"....&.....P......PQ.........@..........................................`.......... ...................................................#......L;.......%......@.......p.......................(...@...@...............X............................text..."........................... ..`.rdata..R...........................@..@.data...PE...@...0...@..............@....pdata..L;.......@...p..............@..@.rsrc....#.......0..................@..@.reloc..@...........................@..B................................................................................................................................................................................................................................................................

C:\Program Files\Statistical Flexibility\DefenderCSP.dll

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	484648
Entropy (8bit):	6.187969937910501
Encrypted:	false
SSDEEP:	6144:CIplbxz2w7YKHbaskU/EVopzcuJKOFu3Vf83Aoh5TKOj8T:dbvYKHusZ/EV0JKoul8QoDbYT
MD5:	BE1F31694A5DAD48C52DA4BE8EA2732A
SHA1:	BA1886889F7776FF9080C3B7AC04E30C39D6D330
SHA-256:	E4B475161E83CBF8B51D33D4425E7EDD6BDCB195D10B33DE46C8BBC555927731
SHA-512:	C7A16D1ACC5001BE5805FAA9C9A740094C38A5F8184D428AD6372952E198D107972F9DB3991588E68DB72940DB1CDD37E76FBBF67107A45682722D4BD436617A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 00120948320943020320948329038902202#U00aacharged.exe, Detection: malicious, Browse Filename: 00120948320943020320948329038902202#U00aacharged.exe, Detection: malicious, Browse Filename: 739Op6J6EZ.exe, Detection: malicious, Browse Filename: 9302850943290000921843029032221#U00bafault.exe, Detection: malicious, Browse Filename: 9302850943290000921843029032221#U00bafault.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U...;...;...;.X:...;.X8...;......;..:...;...:...;..?...;..>.<.;..8...;.X;...;.X2.C.;...E...;.X....;.X9...;.Rich..;.........................PE..d...Q<............" ...&.....................................................p...........`A............................................p............@...........;...@..(%...P..\.......p.................... ..(.......@............!..h............................text...L........................... ..`.rdata..............................@..@.data....Q.......0..................@....pdata...;.......@..................@..@.rsrc........@......................@..@.reloc..\....P... ... ..............@..B........................................................................................................................................................................................................................

C:\Program Files\Statistical Flexibility\Drivers\WdBoot.sys

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21056
Entropy (8bit):	4.977069091703644
Encrypted:	false
SSDEEP:	192:kBt11OWaYpW4tWPVPleFRVWQ46WnVhHssDX01k9z3AJSr3:kvOWaYpW4ZFRWVFDR9zwSr3
MD5:	2857A3D0C7D5EB87E97B239785995831
SHA1:	9F0C11F36DCFAC2501829F461ABBFD386748F198
SHA-256:	AC3BD7BE3F209DDC606E5A7821DD8E7464FFA811C9C6F0C5E8109BBF4F2AA30E
SHA-512:	ACF909D26741133973032C393DD8E98EBA2721D55CA1AAC2FEA4C50AB36912375733F1A4B9AAAD8A8A64E9584A9D88221359DF29CA47DA539EF2DD118DAAAA51
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]m.............Js......Js......i.......i._.....i.......Rich............PE..d....._..........."....&..... .......`...............................................:....`A.................................................................@..`....,..@&......,...@!..p............................ ..@............................................text............................... ..h.rdata..h.... ......................@..H.data........0......................@....pdata..`....@......................@..H.00cfg..0....P......................@..HINIT....`....`...................... ..bGFIDS........p......................@..B.rsrc................ ..............@..B.reloc..L............(..............@..B................................................................................................................................................................................

C:\Program Files\Statistical Flexibility\Drivers\WdDevFlt.sys

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	264600
Entropy (8bit):	6.267672073485891
Encrypted:	false
SSDEEP:	3072:2cQLAoOyZYLpUCmYqtnVBDOhrsmGNovP2CHdOaDjuSzYSvsgKQd32K6nhV:FQsmCqCmYinVBahomos+C9aSFsgn2b
MD5:	134D684B1D2332AFAD5B1D517C1CB92E
SHA1:	F1D6E051AF2E8C156A32706A3269F526777899F6
SHA-256:	01CE54DF58E2151C3A8106DF725DEF5DB68DEBDDE2E0568FEF976062787C6113
SHA-512:	57270F22E9EC1F443BEFCB70536F3C587C50F88639B8828A5865B409528C7FCF0735136500785754527F141C392382032B6539320BB46F7BCC80D631C366F4E9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Q..0..0..0..0..0..0..1..O..0..O..0..O..0..O..0....0..9..0....0.Rich.0.........................PE..d.....^Q.........."....&..................................................... .............A.................................................W..P.......@....0...........%..........P...p...............................@............P..h............................text....y.......\|.................. ..hfothk............................... ..h.rdata...u.......x..................@..H.data........ ......................@....pdata.......0......................@..H.idata..F&...P...(...0..............@..HPAGE.....,.......0...X.............. ..`INIT.............0.................. ..bGFIDS...............................@..B.rsrc...@...........................@..B.reloc..L........ ..................@..B................................................

C:\Program Files\Statistical Flexibility\Drivers\WdFilter.sys

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	601496
Entropy (8bit):	6.336499875895875
Encrypted:	false
SSDEEP:	6144:MQ0L4ZFFpgRzrdTTIumzrzjQL0MAOeFGjHDdnmRahOjfCZnbUtfR/LvnBXj+qvmM:MQ0FTTbcrzjQMGVnCjYCjDwGS0
MD5:	89158C19C510379357EAB414B890BDE6
SHA1:	BBE6CBB373EEF9357B5F7B0DC1900A6D39F78756
SHA-256:	0B929EEC5652E4584708F2944A0C92C0467602BBA2310F45E056A7B012E7F91A
SHA-512:	17CA0E91FFC4B5EBE4ABEC8D8705B26F3D42F2FA73409E38FD8861B96374362820CC8DFC5575CC28FDCD19C7632976FA597F24FBF7E8AC93F5E9E697AD6CBA7D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#..#..#..#.....p..*..p..'..#.."..p..6..p..+..SU.`..SU2."..SU."..Rich#..........................PE..d......f.........."....&............@z.......................................`......\......A................................................(...d............@...=.......%... ..l......p............................-..@............................................text...W........................... ..hfothk............................... ..h.rdata..,.... ......................@..H.data...D....0......................@....pdata...=...@...@... ..............@..H.idata..@3.......4...`..............@..HPAGE....4........................... ..`INIT.....g...p...h...8.............. ..bINIT................................@...GFIDS...d...........................@..B.rsrc...............................@..B.reloc..H=... ...@..................@..B........

C:\Program Files\Statistical Flexibility\Drivers\WdNisDrv.sys

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	105880
Entropy (8bit):	6.155681537666668
Encrypted:	false
SSDEEP:	1536:V2shUPiYuC5qb5mu6QhqxrHtVDEVx1FuSKi92afiKZSO/rBSnLPUzj:LhUaY/EmyCtVFSD2afNU+dO8f
MD5:	9905C23F1A62AD6D1386887CD89F7DB2
SHA1:	D8D613FA67CA83E69CFFE7D842CA6C8FE028813C
SHA-256:	ABA751AE9A1BD59082154A172E0D4B8977DA8E1AFD5F4743D4736EDB775C81AE
SHA-512:	BDAB0B8273005A35EF916C38E0E0A5E41A5D58334B5871F247C9C38F132906105AB3B6E677961BB80F9536A606E55F0392C260F14D42F63740523AA505FD2B78
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^\.3.=.`.=.`.=.`.=.`.=.`IB.a.=.`.=.`f=.`IB.a.=.`IB.a.=.`IB.a.=.`j..a.=.`j..`.=.`j..a.=.`Rich.=.`........PE..d.....)S.........."....&.....d...................................................... .....`A................................................hS..P.......@....@.......x...%......L...x...p...............................@............P..8............................text............................... ..hfothk............................... ..h.rdata..T%.......(..................@..H.data...(....0......................@....pdata.......@......................@..H.idata.......P.......(..............@..HPAGE.........p... ...<.............. ..`INIT.................\.............. ..bGFIDS................`..............@..B.rsrc...@............d..............@..B.reloc...............l..............@..B................................................................

C:\Program Files\Statistical Flexibility\Microsoft-Antimalware-AMFilter.man

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (402), with CRLF line terminators
Category:	dropped
Size (bytes):	13526
Entropy (8bit):	5.280720135047617
Encrypted:	false
SSDEEP:	192:/5mm9AfGjUa1rIL+FUVin2F/OZDfYj5YbAxlqySSS6S8SzSySovK1ZVuB:/5mm9AfGtML+Fws2Fo7m5YcxlKKrVo
MD5:	FA41CDEB03243C5F0341301FDB95206A
SHA1:	8E006DAC462C9AD9D2C0FA1C8BA95E6D1D94382F
SHA-256:	B783898BD2C680A58F4E41D899ADF7C3438B06E426FDACCBEAA68E7A720171D0
SHA-512:	AFEE7763D20110270C4A29E2515830318473298ECC05B74062416D44BFCF80054A9022D2881AF9B12A427371461BB05CC601BE83C2C96AD27910FE7153C2F356
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v3" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">...<assemblyIdentity buildType="release" language="neutral" name="Windows-Defender-Drivers" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" version="10.0.10011.16384" versionScope="nonSxS"></assemblyIdentity>... .. *********************************************************************************************************.. Driver files.. *********************************************************************************************************.. -->...<file destinationPath="$(runtime.drivers)" importPath="$(build.campBinaryImportPath)" name="WdFilter.sys" sourceName="WdFilter.sys" sourcePath=".\"></file>...<file destinationPath="$(runtime.drivers)" importPath="$(build.campBinaryImportPath)" name="WdBoot.sys" sourceName="WdBoot.sys" sou

C:\Program Files\Statistical Flexibility\Microsoft-Antimalware-NIS.man

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (310), with CRLF line terminators
Category:	dropped
Size (bytes):	6173
Entropy (8bit):	5.373156847974759
Encrypted:	false
SSDEEP:	96:/3coK5HjFWr/96Hj+Uul2lewqo3nRtlUl3lflxSDwMKRbRhK18YaKMr4e:/mDFcujBuEgI3nzC1Z6V8f3
MD5:	5562965C32F03AE0DF8B9DEF950F8651
SHA1:	6E5AD734AB6A9F8B82B19024E21007AC2CAD2540
SHA-256:	EA64BE59286B67AE930729FA92B2B08DCE5C2EAEB70FEABE2320C47FB6DDAC6C
SHA-512:	F64D728AFE40800968D0B165019E775F62F2CCA40BFBB370F52F4BA8FCC2574F79D2C4AC41CCAE6E1CEC23082BA24B5E6C0A5531E6B336683BEEEDDA3CB81CDE
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v3" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">...<assemblyIdentity buildType="release" language="neutral" name="Windows-Defender-Service-NisSrvEtw" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" version="10.0.10011.16384" versionScope="nonSxS"></assemblyIdentity>...<instrumentation>....<events xmlns="http://schemas.microsoft.com/win/2004/08/events" xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events">.....<provider guid="{102aab0a-9d9c-4887-a860-55de33b96595}" message="$(string.Microsoft-Antimalware-NIS.provider.name)" messageFileName="%ProgramFiles%\Windows Defender\NisSrv.exe" name="Microsoft-Antimalware-NIS" resourceFileName="%ProgramFiles%\Windows Defender\NisSrv.exe" symbol="Microsoft_Antimalware_NIS">......<tasks>.......<task eventGUID="{b33e041e-3a75-4f52-bf0e-c85d0963b7fb}" name="N

C:\Program Files\Statistical Flexibility\Microsoft-Antimalware-Protection.man

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (335), with CRLF line terminators
Category:	dropped
Size (bytes):	3369
Entropy (8bit):	5.312049604455802
Encrypted:	false
SSDEEP:	96:/3poK58yFND08uf9zXzUzCzwat0kz9nHHzyPYjHMrje:/FbFHuf9DzUOVJ1HHePv2
MD5:	E4AD891E7B62475FCA109C0DF4DEF16E
SHA1:	B7DC3C04C67D7903E04B0EBF2AB7840AAA717EE0
SHA-256:	DF9AD93CDB61587A35FCDCE996955A64413439A474D85C86133A9E9C185D1966
SHA-512:	0849CB6F3DAA6C80B94F770E29BD389B67D31E089595B22BFAF1D6F25C6E847DA4DCBFF135F6D96E30597991FF6C8CA8EB5306C4E8D1B334016220058B2969E1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v3" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">...<assemblyIdentity buildType="release" language="neutral" name="Windows-Defender-Service-MpClientEtw" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" version="10.0.10011.16384" versionScope="nonSxS"></assemblyIdentity>...<instrumentation>....<events xmlns="http://schemas.microsoft.com/win/2004/08/events" xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events">.....<provider guid="{e4b70372-261f-4c54-8fa6-a5a7914d73da}" message="$(string.Microsoft-Antimalware-Protection.provider.name)" messageFileName="%programfiles%\Windows Defender\MpClient.dll" name="Microsoft-Antimalware-Protection" resourceFileName="%programfiles%\Windows Defender\MpClient.dll" symbol="Microsoft_Antimalware_Protection">......<tasks>.......<task eventGUID="{7db81ddd-d2be-41bd-

C:\Program Files\Statistical Flexibility\Microsoft-Antimalware-RTP.man

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (308), with CRLF line terminators
Category:	dropped
Size (bytes):	17689
Entropy (8bit):	5.293180860697046
Encrypted:	false
SSDEEP:	192:/ozFIItP1HvYoPp5z7YlAZdJwgwFAfnyygnGJ2HNfEj:/QFIwP1PYoh5WAZdJwg9vKGJ2ZC
MD5:	584F8D2C2089220B72E101B801FE46DC
SHA1:	093D81D9EFB1339C301EE83631E4C70D494394BF
SHA-256:	5A2CDDF781BA67E79FBC8ACB6099E51847F67CFAE817C6DAF1BEB7D176700357
SHA-512:	C298E75784660C957AF88BA82239CF65BCE24A92549B0350CD57B52BDF90BDBD7C5E603CD73A878EBD145965D218657A5DB6263CA4D4212D71B529307346B62B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v3" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">...<assemblyIdentity buildType="release" language="neutral" name="Windows-Defender-Service-MpRtpEtw" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" version="10.0.10011.16384" versionScope="nonSxS"></assemblyIdentity>...<instrumentation>....<events xmlns="http://schemas.microsoft.com/win/2004/08/events" xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events">.....<provider guid="{8e92deef-5e17-413b-b927-59b2f06a3cfc}" message="$(string.Microsoft-Antimalware-RTP.provider.name)" messageFileName="%programfiles%\Windows Defender\MpRtp.dll" name="Microsoft-Antimalware-RTP" resourceFileName="%programfiles%\Windows Defender\MpRtp.dll" symbol="Microsoft_Antimalware_RTP">......<maps>.......<valueMap name="DlpOperationType">........<map message="$(string.Ope

C:\Program Files\Statistical Flexibility\Microsoft-Antimalware-Service.man

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (320), with CRLF line terminators
Category:	dropped
Size (bytes):	33703
Entropy (8bit):	5.252564612525564
Encrypted:	false
SSDEEP:	384:/VFriW4cboWcauSi6fZeeEifUhwqh+UiAJJCZvsp33icjEtRMWR2CEaXU1Hgb1R5:tFriHcblBLQJ1ycgtOmNXNxBn
MD5:	5940A563DA6089EA2406D6B19203B978
SHA1:	D36DA20DF8E6B506BD6BCD5D70ED6CDB500F4987
SHA-256:	8A6003942BFDC813608A8C8B69A1CBAB561CBE1FB2FD1184606A8C62DEDE9955
SHA-512:	B99925E2947F9E2373A36C7CCBC02A7E91338B7EC368734835273A3AFB4B92C8AD18754ED4226BBC8A04AB92F7EABACFF7E1799365F30E9204BF15FFE22BA552
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v3" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">...<assemblyIdentity buildType="release" language="neutral" name="Windows-Defender-Service-MpSvcEtw" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" version="10.0.10011.16384" versionScope="nonSxS"></assemblyIdentity>...<instrumentation>....<events xmlns="http://schemas.microsoft.com/win/2004/08/events" xmlns:ms="http://manifests.microsoft.com/win/2004/08/windows/events" xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events">.....<provider guid="{751ef305-6c6e-4fed-b847-02ef79d26aef}" message="$(string.Microsoft-Antimalware-Service.provider.name)" messageFileName="%programfiles%\Windows Defender\MpSvc.dll" name="Microsoft-Antimalware-Service" resourceFileName="%programfiles%\Windows Defender\MpSvc.dll" symbol="Microsoft_Antimalware_Service">......

C:\Program Files\Statistical Flexibility\Microsoft-Windows-Windows Defender.man

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (374), with CRLF line terminators
Category:	dropped
Size (bytes):	152765
Entropy (8bit):	5.480395622623381
Encrypted:	false
SSDEEP:	1536:5oQofFL81KSYfSN8bvc0/E/EvJ4rfVEcej+PV5Fc9HCeKK1HVX:SBfBtKK1HVX
MD5:	2A92C4BC9830008015D14C5082AEBB79
SHA1:	D9DE3ACA822692AD26A0FE71C55799803E65F770
SHA-256:	C65012C164E4E8BDB82459C490A4C93BD7DCD4BD7A255D754748A5952F4E9D67
SHA-512:	0543B294F3EF3E38CC37ED451D81F4A0F67A728ECCBBFD89D05D63C7F235DC33252A359078C1B53DF5DF74F2DE6441A26FD89D2FC58E973AB31038B8CD90B81D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v3" xmlns:xsd="http://www.w3.org/2001/XMLSchema">...<assemblyIdentity buildType="release" language="neutral" name="Windows-Defender-Events" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" version="10.0.10011.16384" versionScope="nonSxS"></assemblyIdentity>...<dependency discoverable="false" optional="false" resourceType="Resources">....<dependentAssembly>.....<assemblyIdentity buildType="release" language="" name="Windows-Defender-Events.Resources" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" version="10.0.10011.16384"></assemblyIdentity>....</dependentAssembly>...</dependency>... .. ********************************************************************************************************.. BEGIN FILES SECTION .. *********************************************************************************************************.. --

C:\Program Files\Statistical Flexibility\MpAsDesc.dll

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	210328
Entropy (8bit):	5.232186453820253
Encrypted:	false
SSDEEP:	6144:AnmiTVVmVVV8VVNVVVcVVVxVVVPVVlVVVRVVVtVVWV60jVLVVOVVUVZVVVVVjVVL:6/1f
MD5:	79A8AAC10C10BBA212448C7791EB5C5D
SHA1:	DC303A4A2468EC26B47B456D1E0A29F5EAEF3F39
SHA-256:	27F5576A7B88FE96F6124AC95192C1B6B4EDC3A42A9AF6DD1813C15787896E90
SHA-512:	789AE063853286764F5BAB6DBC9D6CA45AFA4A275ABB1B44BB2C7E1F102BD492F04D87FA36A87CCD232BE44CD55EF33ECB0B4788FD7BB41949DF723479F42C5D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X=..9S..9S..9S......9S...Q..9S.Rich.9S.........PE..d.....&F.........." ...&..................................................................`.......................................................... ...................%..............T............................................................................rdata..............................@..@.rsrc........ ....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Statistical Flexibility\MpClient.dll

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	312832
Entropy (8bit):	6.333218692336459
Encrypted:	false
SSDEEP:	6144:+PODXqZQpSylPma9xhItaiUO1w2ohzAw7KLM:+2DPpSxIIt7ouC
MD5:	4012C5A6793B527937396EA152F10356
SHA1:	4247190CBD0D2D8BA4FB9A50A1095D9DCCA8CBCC
SHA-256:	79C1EC4738BFA818D85E09A713C7F396F84ED2780AFF9B4AEE43C0A28601C0CF
SHA-512:	73B8DE357740056AC4FC0278739D2D49B13CCEF3992CAECA91411104AFC26D422C56B0279B92E9CA2DE5BD74205E0A2FBA4C8EF8AC0E43AFD9E843A061630BB9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d..h ..; ..; ..;4.:..;4.:3..;4.:...;@.:...;@.:..;@.:c..;4.:/..; ..;...;D.:"..;D.:!..;D.^;!..;D.:!..;Rich ..;................PE..d....r.f.........." ... ............<........................................ ............`..........................................S...'...{..................\|&..............`.......p...........................@...@............ ...............................text...<........................... ..`.rdata..0h... ...j..................@..@.data....)...........\|..............@....pdata..\|&.......(..................@..@_RDATA..\...........................@..@.rsrc...............................@..@.reloc..`...........................@..B................................................................................................................................................................................................

C:\Program Files\Statistical Flexibility\MpCmdRun.exe

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1658408
Entropy (8bit):	6.337474663380479
Encrypted:	false
SSDEEP:	24576:5sEAe5f4ut17rYefIUV+AUqXbZjSS/qdh9fmsoqXgUgf/n:CS5joefIUV+vaFjH/qRan
MD5:	E9F752EE80EB05F087622B8098E3D90C
SHA1:	D310A3EE4CEF4A4D3AAD564003C537DD48A907E7
SHA-256:	4B3517F91892BA8675DFA1FEC0949AFFB6A61D3D1536404E1591D398CC65323F
SHA-512:	D30AF91755F108AE5131392CA421E2A9893ABB94623CC855F33A3E8711AB3D2970765680A4CEE161A494B4112EC006F5D9EDED4B4BF8069B288CA8E2C9140446
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v...2.2.2.Ba..3.;.8.0.Ba..0.a.....a...3.a...$.a...#.2...Ba.....&.;.BaT.3.Ba..3.Rich2.........PE..d.....2..........."....&..... .................@............................. ....................... ...............................................0..........l.......(^..........,...p....................v..(... 2..@........... w..x.......@....................text............................... ..`.rdata..~...........................@..@.data...d........p..................@....pdata..l............P..............@..@.didat..`.... ......................@....rsrc........0......................@..@.reloc........... ..................@..B........................................................................................................................................................................................................

C:\Program Files\Statistical Flexibility\MpCommu.dll

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	374168
Entropy (8bit):	6.124067183767155
Encrypted:	false
SSDEEP:	6144:Cz1Yl9OFK2OMF35gOXYVJFpIjl2Ub6Mnb7vS3:0Y/OFKvM83VJ2oSng
MD5:	467FC393010D5FA54A1829AD1DA59480
SHA1:	425ACE5680EE6BD861F91623D570A5486859B097
SHA-256:	70BB48562208B65B7162FF46B1356E5BB0A77E29DADC9C093AAFEB97F4CF9EF3
SHA-512:	8EC71B4AA64DEDF4D0ABE68D5A659A4793E4C30DEC0B088A08B7BC52708CB3749FCCF96D540D3186944B917501C0DF21561AD0F2C87BAF910859249EE222F134
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......jwA.../.../.../.^...,./.^.,././.}i..#./.}i+.>./.}i,.$./.'n..<./....../.}i*.../.^./././.^.&.Q./.^..././.^.-././.Rich../.........PE..d....{..........." ...&.......................f.....................................k....`A................................................`...........(....@...0.......%......<....H..p................... ...(.......@...........H.......l........................text...<........................... ..`.rdata...(.......0..................@..@.data....'....... ..................@....pdata...0...@...0...0..............@..@.didat..`....p.......`..............@....rsrc...(............p..............@..@.reloc..<...........................@..B........................................................................................................................................................................................................

C:\Program Files\Statistical Flexibility\MpCopyAccelerator.exe

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	187416
Entropy (8bit):	5.494907302896488
Encrypted:	false
SSDEEP:	3072:u0LRJdOtOgesCaGTz7lY+KTeZD+EykhglaLtLQK1V31:hfOtO16SVXD+Ey3k5Bl
MD5:	8D3657A3394CBCC1B0EDD6E0FF3394B7
SHA1:	3CF38163943AB0082B7CF930657E80D33040D495
SHA-256:	1A7850CE8C9A284EEA1FBF3785970E73C1084C6069CA87C11FECFD20B7230316
SHA-512:	59D4B822659FD461426E7E81A3528D107397D2B3176DC99E511B2A700DD363EB459F931D761CBBEA4F50255EA9EE6B6E8A424A6105041B68A345C984A485B5B4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w..3..3..3..C&.1..C&.2..`..#..`..9..:.^.'..`.....`..:..3.....C&.m..C&2.2..C&.2..Rich3..........PE..d...... .........."....&.0...........&.........@..................................................... .................................................. .......0........,..........pq..p....................G..(....@..@............G..x............................text...\|(.......0.................. ..`.rdata...o...@...p...@..............@..@.data...............................@....pdata..0........ ..................@..@.rsrc... ...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Program Files\Statistical Flexibility\MpDefenderCoreService.dll

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	236544
Entropy (8bit):	6.229214314516456
Encrypted:	false
SSDEEP:	3072:Kt1HtViq36dgUh5p2O5jD9xd+mD87K/3ZNeorboY46cr3zaA6Gw4:KJVz3iNh5p2S39xdtvohvzcP
MD5:	F6F52F46F9B5171383319B9DA8AEE148
SHA1:	EC02AE29DCEDA6722D41588131418BA1F9B4193B
SHA-256:	B123F45A35ECFABBF6C82C1E13F58BAE461A1978D03B7F690DE820047B6E2A5D
SHA-512:	79CF0817D049417F49B9177AE8D6F284AF1378830EB9A0F946A5521295D332043DD24943D702C69AB691DF0E428150F0562DC230F520CAFD70AB3D3CDBA79BF5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........4jc.U.0.U.0.U.0.>.1.U.0.>.1.U.0.>.1.U.0./.1.U.0./.1.U.0./.1.U.0.>.1.U.0.U.0.U.0./.1.U.0./.0.U.0./.1.U.0Rich.U.0........PE..d...d..f.........." ... .4...z.......y....................................................`..................................................c..P...............H!..............<....'..p............................%..@............P.. ............................text... 3.......4.................. ..`.rdata.......P... ...8..............@..@.data....)...p.......X..............@....pdata..H!......."...l..............@..@_RDATA..\...........................@..@.rsrc...............................@..@.reloc..<...........................@..B................................................................................................................................................................................................................

C:\Program Files\Statistical Flexibility\MpDefenderCoreService.exe

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	261800
Entropy (8bit):	5.382093119798553
Encrypted:	false
SSDEEP:	6144:ISumjmiTVVmVVV8VVNVVVcVVVxVVVPVVlVVVRVVVtVVWV60jVLVVOVVUVZVVVVVY:ISXp6
MD5:	DE7832778A78C006D3830CB376E6DF43
SHA1:	BDB1F2F1E3A3F883CEC5AB03279842121C1B6620
SHA-256:	5DEEA3215E6D7A01D2C04EDD6273A294EB53A266791655FC42020DA45EB51081
SHA-512:	1700B164F93F4C34EB3E5FFF2557C0895DB9B2602B95A539D348D1E358EC0A4DF4A902899F591FC56E3154F93B72B89ABF6684CC0F3DA215566C358DB37A8365
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*Z]jn;39n;39n;39..28l;39..08o;39=D78`;39=D08f;39gC.9~;39=D68^;39=D28e;39n;29.;39..:8u;39...9o;39..18o;39Richn;39................PE..d...F#I=.........."....&.p...P......P..........@..................................................... .................................................................................p.......................(.......@...........(................................text...\|d.......p.................. ..`.rdata..r%.......0..................@..@.data...h...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Program Files\Statistical Flexibility\MpDetours.dll

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	243096
Entropy (8bit):	5.805219722668913
Encrypted:	false
SSDEEP:	3072:Hggg7q4BR4J1225+bXJvfnNOzqbXaIv66hel34Bjjr9FGT2/1y4lFFLsuLcW+9gU:R/512250IoBb9wgFFpgWumf9HPq
MD5:	EA3D0B55B592672C3A61701A39922C0C
SHA1:	BFB48405E495EED4556E7A6F7862FDE8C13A27A4
SHA-256:	D51F80740B3A6063736370FCBF6B442C7C2D7EA9A05DBF2B08E0D170B9D83A2B
SHA-512:	51F447EE49C98901D5D7025BAAC11A89DA806F60D1F41FDC29DB919BCEA8A76CDAAA01E4528876EFA131FA5B5FBE6DF5DC36B9AB613B3C6F1669EAA88D29620C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-B..L,.L,.L,.../.L,..3-.L,..3(.L,..3/.L,.4..L,.L-..M,..3).L,...,.L,...%..L,.....L,.....L,.Rich.L,.........PE..d...,..K.........." ...&. ...p......@...............................................n.....`A........................................p...................(.... ...........%.......... ...p....................?..(...`>..@............?...............................text...R........ .................. ..`.rdata......0.......0..............@..@.data....!....... ..................@....pdata....... ... ..................@..@.detourcp!...@...0...0..............@..@.detourd.....p.......`..............@....rsrc...(............p..............@..@.reloc..............................@..B........................................................................................................................................................................

C:\Program Files\Statistical Flexibility\MpDetoursCopyAccelerator.dll

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	112024
Entropy (8bit):	5.265289937339589
Encrypted:	false
SSDEEP:	1536:H4mvEyOAuj3f97PLgdBuoR7TGu8VNRPdLPbEp4zb:JEyO3A0o1L8HBVTXf
MD5:	FB0E267974826E57D68C3D90FD729C97
SHA1:	7798FFE241A874D1D47E52906699678601DED4A3
SHA-256:	5FC1ED9E196237DE4CFEBD5B0446DEF0B3518B8782F86D8E0A946872197C349D
SHA-512:	B0CB9799EABA04C7302485505482CDD96272B0BD57095BA79890BD54159B72DA54023BF86654774B361C33B7ACC600506DB7BCFBBCA0B2443CFAAF5F87248953
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................g...........................\.................g.......g.......g0.....g......Rich....................PE..d...T..F.........." ...&.............................................................=....`A............................................H...8................0..<........%.......... ...p...................P...(.......@...........x................................text............................... ..`.rdata..\8.......@..................@..@.data...............................@....pdata..<....0....... ..............@..@.detourcp!...@...0...0..............@..@.detourd.....p.......`..............@....rsrc................p..............@..@.reloc..............................@..B................................................................................................................................................................

C:\Program Files\Statistical Flexibility\MpDlpCmd.exe

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	393912
Entropy (8bit):	5.820930880165877
Encrypted:	false
SSDEEP:	6144:oHzOhG797kAulm7J+miTVVmVVV8VVNVVVcVVVxVVVPVVlVVVRVVVtVVWV60jVLVB:kzH7lkAtUAI
MD5:	2CDF80CE73859A3E62254F3A36ABFB94
SHA1:	BA9842A5E737B3D1FF3F5D5DA732F68CB22CBE80
SHA-256:	6C52CF381C697790A8FC05EE0A799329D80B249633ECB58D28AC3A37C5D2F27D
SHA-512:	E9B5F0D2EE2A47BF85C1B3292D788148ACAD1CF131B67A74BC8FF14A7335CE55B8F4911AB920713E015D590B4AFD5FF55208C7EFC3F1033E6592B7EC19735C38
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6..Or...r...r....C..p....C..s...!...b...{.k.`...!...@...!...~...!...g...r.../....C..!....C..s....C..s...Richr...................PE..d...'..:.........."....&............`..........@....................................Q................ ......................................lX..T...............<........2.......... ...p.......................(.......@............................................text............................... ..`.rdata.............................@..@.data........p.......p..............@....pdata..<........ ..................@..@.rsrc............ ..................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Program Files\Statistical Flexibility\MpDlpService.exe

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	732840
Entropy (8bit):	6.304951515714282
Encrypted:	false
SSDEEP:	12288:bAYPHFrSdjVwYt4Wd6wEkBCzoY//EsroE9eeDn1r:sY/FrSdyYtld7Y//EsrweDn1r
MD5:	E7225316FA60848214F19972DABA725D
SHA1:	43D0443B8DFE9498B8E61976FC83919CCD4E221C
SHA-256:	A4CD3CD3EB4FD0AF57FD42B45C660CB74BD4D5CB29362597FB7E54178F00CF74
SHA-512:	F38DBDD6388778508277D4E1FD1B410FD7FC37121388FD45509CED397A0CD88BA41C896CCA34859A6E3CC9E85AF2E99A91093AA6E4F71E838AAC92222512429B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........89..YWW.YWW.YWW..TV.YWW..VV.YWW.&SV.YWW.&RV.YWW.&TV.YWW.&VV.YWW.YVW3XWW.)W.YWW..^VKYWW..W.YWW..UV.YWWRich.YWW........................PE..d...kw............"....&.....p......._.........@..................................................... ...................................... ...........8.......XS.......>......`....K..p.......................(...@...@............................................text...R........................... ..`.rdata..............................@..@.data....M...0...0...0..............@....pdata..XS.......`...`..............@..@.rsrc...8...........................@..@.reloc..`........ ..................@..B........................................................................................................................................................................................................................................

C:\Program Files\Statistical Flexibility\MpEvMsg.dll

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	148888
Entropy (8bit):	3.871027747480385
Encrypted:	false
SSDEEP:	768:bdsWuK37OeBkG22Tumo0cTH6QKqCmuKqrWmNKq4mZKqdmjU4KqpmC+YBd1PkOe9l:ZDBkG2us/LPkOazKt2
MD5:	F9091EC0D8233AE85C7E10D51F12FB1D
SHA1:	02D31B5CB94967A5EABE3B018A5B07BE91729935
SHA-256:	D49D4DE108393CABAE812BF0414A8769C04AB37D4749B5499CE7ECF85940C546
SHA-512:	BE7A9F6E2284CD1C608EC04DC8481A22C50EC1D59C167D62B403AAA3FDBB81AD2148E24DF434BBFD81D81885EF4A1BC51488471C17D19E036485A30BD110CCA9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X=..9S..9S..9S......9S...Q..9S.Rich.9S.........PE..d...k+f..........." ...&..................................................... ............`.......................................................... .. ............ ...%..............T............................................................................rdata..............................@..@.rsrc... .... ....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Statistical Flexibility\MpOAV.dll

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	529816
Entropy (8bit):	6.068026451268802
Encrypted:	false
SSDEEP:	6144:lwF+9b9MtsE1mUnWNXRq56P2IKohYo8miTVVmVVV8VVNVVVcVVVxVVVPVVlVVVR9:lwFSbAV1mUmXU56uIKom0
MD5:	6E5546EB47DAABAA407A1CC8843BBFC2
SHA1:	A0AF46B97CBAD74BF57D693EADE0758A3D3D9C30
SHA-256:	394B494FD2A291D30D186342D7059249C9394930B1EA9F49FA1CFCD5B568E9B6
SHA-512:	FCB8B7EF7B7E17213625F1347966DCE5F3277F1E425294AE6581E6E4E426EE2CAAD5D4C17CE36233E5377353B85F3AA0AB2A10ACD5C85245883BA1BD4B06CABE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H3.3.R.`.R.`.R.`\|.a.R.`_-.a.R.`.R.`2S.`_-.a.R.`_-.a(R.`_-.a.R.`\|.a.R.`\|.afR.`\|.~`.R.`\|.a.R.`Rich.R.`........................PE..d................." ...&.@....................._....................................)Q....`A................................................d...x....... .......8%.......%...........!..p....................x..(....w..@............x...............................text....=.......@.................. ..`.rdata..`E...P...P...P..............@..@.data...P7....... ..................@....pdata..8%.......0..................@..@.rsrc... ...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Program Files\Statistical Flexibility\MpSenseComm.dll

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	923032
Entropy (8bit):	6.315054653274608
Encrypted:	false
SSDEEP:	12288:6IgMaWXYjqOZ7XBrCf2azpegyiLLJhrxnzCGyeAoztwtGUk0NfY3:6I1agd4XW2aJXLLJdQGZASkGUk0q3
MD5:	BD47C5E9B8AE8EA1D1BEB0D6DE268C60
SHA1:	8204B9C9B224A3823954356DA8DE695427A7EC07
SHA-256:	9A04D938D0F035AAADE9543D6C5A0DE6DD17D9F9D3C49E15AB2AE48E910B7516
SHA-512:	3A071C8512A0BC7B7B56B253C832F02BA627955D07FC65F33FCBA711562DDCF5459FFE8C7E7174B76ED94CFA54373B15D4BAFEA8E8E04F1DF0D9E340744BBEB7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V...7...7...7...H...7...7..V7...H...7...H..17...H...7.......7.......7....o..7.......7..Rich.7..........PE..d.....r~.........." ...&.p...............................................................`A........................................0z..\|....z..x....... ....p..`i.......%.......... ...p................... ...(.......@...........H................................text...\c.......p.................. ..`.rdata..............................@..@.data...............................@....pdata..`i...p...p...P..............@..@.rsrc... ...........................@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................

C:\Program Files\Statistical Flexibility\MpUpdate.dll

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	161176
Entropy (8bit):	5.8418705759582625
Encrypted:	false
SSDEEP:	3072:mCR/16Us8Lzfkzo8QL+i/UKTeUpgbV4aT/:vFYU5L4MDgl7
MD5:	14257B15D823C24CED3A042735FA9655
SHA1:	A72C87DA22E47C2659D71C8BCBD66EF3158043AA
SHA-256:	0518E6DDED7AE3D5890E9FA57B25512E9BD6DD669665C9B383A7C1A0028907BB
SHA-512:	8C05E23641447F5AA726D67C8727D4DA07A5C54C06EBFFFFF3F4938315DAEFDF6DCBBE018D0BAC550B517DA629AD8D7A45FA3B5103A36ED7E71D702A94C61D0F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Z{..Z{..Z{.....[{.....X{......K{......U{......P{..S...H{..Z{...z......p{.....[{.....5{..}..X{...m.[{.....[{..RichZ{..........PE..d...,.O..........." ...&.@.....................h.............................`......7.....`A............................................L............@....... ..L....P...%...P..\|... ...p....................w..(....u..@...........8w..0............................text....>.......@.................. ..`.rdata..d....P.......P..............@..@.data...............................@....pdata..L.... ... ..................@..@.rsrc........@.......0..............@..@.reloc..\|....P.......@..............@..B........................................................................................................................................................................................................................................

C:\Program Files\Statistical Flexibility\MpUxAgent.dll

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	578968
Entropy (8bit):	6.017778010754948
Encrypted:	false
SSDEEP:	6144:XnnK9Evd4Du1v+BtbepUa14ZOqnXH2DszmUkF17VL6tHiTVVmVVV8VVNVVVcVVVB:XK9IN1v+vbeOA4ZPX2DszmUkFNh9G
MD5:	82C7D904A74CEF6384D9D620DF5C26DB
SHA1:	9B6F68FE69BB063DA7153A220CEA275DE5B9FD28
SHA-256:	B6EBB52B190B4303EA948B6D52FB6C69FBEFAF1F80E02771692DDB6819196951
SHA-512:	B12AE4F4DEFFC6F10477112AC30451C8A6C702F42DE1466F5729EC4E64B8770D5F1B62F6AEAD1C79DB295CE14DEFF04A46FE8127D3B25EA190837D8C9338AE53
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............Op..Op..Op..s..Op..q..Op.0q..Op.0t..Op..7...Op..Oq.yNp.0u..Op.0s..Op..p..Op..y.Op....Op..r..Op.Rich.Op.........................PE..d....^$..........." ...&.............3..............................................Xq.....A........................................0$.......$...................(.......%.......... ...p....................2..(...@1..@............2...............................text...<........................... ..`.rdata..*4.......@..................@..@.data........P...0...P..............@....pdata...(.......0..................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Program Files\Statistical Flexibility\MsMpEng.exe

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	133704
Entropy (8bit):	5.8845566050921985
Encrypted:	false
SSDEEP:	3072:6NRjJBqqRUOYuAWMHIiKTeUeRJtbPatts/pnyg:EdBqqGjpJzPcK0g
MD5:	D23A35BFFCDB4C9391C6BF153707D993
SHA1:	48CC3E0F6976C53336E973A067833C0A6A446DA9
SHA-256:	B40F8B223BF8EB57B9ECE0E220E28FA100CC0171B663BD5F7D019E473BC20FA7
SHA-512:	6CB03D70FD97BCD19493DE556574A13EEF941E40BCE691D6D006C6F2149F6C2CADEE44845B26E0D2AF9A177A8820AF44B647C463914BAEDCEC980FD6E414C0C6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Z..................................2..................................^.............Rich....................PE..d................."....&. .....................@............................................................................................\~..........H...............H*......h....K..p................... 4..(....2..@...........H4.. ............................text...B........ .................. ..`.rdata...]...0...`...0..............@..@.data...............................@....pdata........... ..................@..@.rsrc...H...........................@..@.reloc..h...........................@..B........................................................................................................................................................................................................................................................

C:\Program Files\Statistical Flexibility\MsMpLics.dll

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21912
Entropy (8bit):	4.764708323229775
Encrypted:	false
SSDEEP:	192:xWg4HWqALc2Fu462TNZ90XhBNhDBQABJKqGowKUWX01k9z3AvoHcnu1:xWg4HWq1MJsdDBRJa2R9z8oiu1
MD5:	32BEAB98B321908F439DEEBAEE95729A
SHA1:	8C50B92796B94BA168127D0CD75A14338A088A10
SHA-256:	221D1176BCCFB90BF7E0114283ABFC87B45B1D812CD32FE1514A544C3F670DAD
SHA-512:	70422E05A7CE1985179E209EF0688FEED7AC4E24A503A84C848A4EE48E99F81165A2730BA79008D7265D956559E17A987253029B1E5F07D1966BE9E00EEA692F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X=..9S..9S..9S......9S...Q..9S.Rich.9S.........PE..d....y............" ...&..... ...............................................0......^D....`.......................................................... ...............0...%..............T............................................................................rdata..............................@..@.rsrc........ ....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Statistical Flexibility\Powershell\Defender.psd1

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15357
Entropy (8bit):	5.984275964674147
Encrypted:	false
SSDEEP:	384:gBaZ5YXf6zb+NlxuGLrNBC6dV0EajsZqqQFy0kzzfOWav2+MhkH/oYMy3p:lYvib+F/rNBCAV0DQUqQFy0kzjOf+jhK
MD5:	51E64B3C27EABB72CAFD083ACAE69F6D
SHA1:	AAE0DF07A992347BB85C7DEED10116FBA921A99C
SHA-256:	F127CA97BAF9B7BF6402BB83DB52B8D9A5EE286AEB4D899DBDD7F5B960479EC1
SHA-512:	D8B84DA8CF79F18020F9DAC7F4EDD37CCF9F18B632BB6E1175A2B627102327C338DE323E1CD2DABB6F214A8E6C4EB77B42ED8C71DFA5462927685F1C564CB442
Malicious:	false
Preview:	@{.. GUID = 'C46BE3DC-30A9-452F-A5FD-4BF9CA87A854'.. Author="Microsoft Corporation".. CompanyName="Microsoft Corporation".. Copyright="Copyright (C) Microsoft Corporation. All rights reserved.".. ModuleVersion = '1.0'.. NestedModules = @( 'MSFT_MpComputerStatus.cdxml',.. 'MSFT_MpPreference.cdxml',.. 'MSFT_MpThreat.cdxml',.. 'MSFT_MpThreatCatalog.cdxml',.. 'MSFT_MpThreatDetection.cdxml',.. 'MSFT_MpScan.cdxml',.. 'MSFT_MpSignature.cdxml',.. 'MSFT_MpWDOScan.cdxml',.. 'MSFT_MpRollback.cdxml'.. ).... FunctionsToExport = @( 'Get-MpPreference',.. 'Set-MpPreference',.. 'Add-MpPreference',.. 'Remove-MpPreference',.. 'Get-MpComputerStatus',.. 'Get-MpThr

C:\Program Files\Statistical Flexibility\Powershell\DefenderPerformance.psd1

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14535
Entropy (8bit):	6.003978692579662
Encrypted:	false
SSDEEP:	384:pZ5YXf6zb+NlxuGLrNBC6duEante4UA7MqQFET1upkzzfOWav2+Yif7H/A55VUY:1Yvib+F/rNBCAuDnte4UAAqQFppkzjOe
MD5:	A75B99C415A9CA7BEFBDB3052E16D282
SHA1:	9125A800476852A9DE4007CF66B5F689BB44C011
SHA-256:	C9040E740A32EDF74D4B6E761011CD6648015BD939AF0F23143AAFB49136FBA5
SHA-512:	77DEF9D5D95018F57BF96FA7F517CC22883708AFA8637F8F8246BEA9064C63863656360C76D78623BF8EAADFDCBE9A7AC6E3CCA52E91A126229A3A9341EA482D
Malicious:	false
Preview:	@{.. GUID = 'A51E6D9E-BC14-41A7-98A8-888195641250'.. Author="Microsoft Corporation".. CompanyName="Microsoft Corporation".. Copyright="Copyright (C) Microsoft Corporation. All rights reserved.".. ModuleVersion = '1.0'.. NestedModules = @('MSFT_MpPerformanceRecording.psm1').... FormatsToProcess = @('MSFT_MpPerformanceReport.Format.ps1xml').... CompatiblePSEditions = @('Desktop', 'Core').... FunctionsToExport = @( 'New-MpPerformanceRecording',.. 'Get-MpPerformanceReport'.. ).. HelpInfoUri="http://go.microsoft.com/fwlink/?linkid=390762".. PowerShellVersion = '5.1'..}....# SIG # Begin signature block..# MIImEQYJKoZIhvcNAQcCoIImAjCCJf4CAQExDzANBglghkgBZQMEAgEFADB5Bgor..# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG..# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCC5QoGq9EV41ZN5..# fnwNlxKx8aIBP8W7y/AxkQ4SrJmPcKCCC2IwggTvMIID16ADAgECAhMzAAAK69Nl..# RIMWPjjtAAAAAArrMA0GCSqGSIb3DQEBCwUA

C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpComputerStatus.cdxml

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	15813
Entropy (8bit):	6.009549420991249
Encrypted:	false
SSDEEP:	384:qj50bJ63v4xmqORkhdB95kaRhubNdm8gQMzg4kHN+KaJqHcISZz/ddmL:k09uvo3dB95jcelQMzg4kHN+zgvSZz/4
MD5:	3F3C2C71679AB50465E52E9F009F8A8B
SHA1:	EB726E5AF4CE8F8A80F5F9CF63DBF2C5E183C56B
SHA-256:	DC55F458E900FFF28DF32C8AC60A37890A8E4A85EE0605952BD971A4C1C91857
SHA-512:	D9389D403BC0534809D67A2ADFDB06CAAE75C740004F454B7EA8B502DAC7080D3A72E9B4DE06C4808FE7F4C4B16C98D6F7A665AA9748E7E432447457C9ECD50F
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<PowerShellMetadata xmlns="http://schemas.microsoft.com/cmdlets-over-objects/2009/11">.. <Class ClassName="ROOT\Microsoft\Windows\Defender\MSFT_MpComputerStatus">.. <Version>1.0</Version>.. <DefaultNoun>MpComputerStatus</DefaultNoun>.... <InstanceCmdlets>.. <GetCmdletParameters DefaultCmdletParameterSet="DefaultSet">.. .. </GetCmdletParameters>.. </InstanceCmdlets> .. </Class>.. ..</PowerShellMetadata>........ SIG # Begin signature block -->.. MIImEQYJKoZIhvcNAQcCoIImAjCCJf4CAQExDzANBglghkgBZQMEAgEFADB5Bgor -->.. BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG -->.. KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCCGKubREngV5EF -->.. DodK5brTAqlkaVHav/M+SkqGWqFKKqCCC2IwggTvMIID16ADAgECAhMzAAAK69Nl -->.. RIMWPjjtAAAAAArrMA0GCSqGSIb3DQEBCwUAMHkxCzAJBgNVBAYTAlVTMRMwEQYD -->.. VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy -->.. b3NvZnQgQ29y

C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpPerformanceRecording.psm1

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	80650
Entropy (8bit):	5.3978802620436985
Encrypted:	false
SSDEEP:	1536:yP1YeVLqzm4vFo1BWMWuT7qCW+H/8kQYl9mrd3wG8OGPDKQxV1AcJRBF/AwgFXb1:yCehqzm4vFo1BWMWuT7qCW+H/8kQYl9A
MD5:	A161870070262A191C70A786FE37E50A
SHA1:	65D5878D007A6ED575698D6145E93BA7CE2E1835
SHA-256:	4856DB6F83BBF20686D84DBC7CA2195AD6C98A30F88E92A3D103293C028D328F
SHA-512:	AF45AE5B821D26B0D6C778225076A175D0D53986929D45D8D9922D89E10FBE0EA4D1D3DBEF5C9E53B5EFC0E4691AC5C520304504ADED6991C3CDC34BA59638D7
Malicious:	false
Preview:	## Copyright (c) Microsoft Corporation. All rights reserved.....<#...SYNOPSIS..This cmdlet collects a performance recording of Microsoft Defender Antivirus..scans......DESCRIPTION..This cmdlet collects a performance recording of Microsoft Defender Antivirus..scans. These performance recordings contain Microsoft-Antimalware-Engine..and NT kernel process events and can be analyzed after collection using the..Get-MpPerformanceReport cmdlet.....This cmdlet requires elevated administrator privileges.....The performance analyzer provides insight into problematic files that could..cause performance degradation of Microsoft Defender Antivirus. This tool is..provided "AS IS", and is not intended to provide suggestions on exclusions...Exclusions can reduce the level of protection on your endpoints. Exclusions,..if any, should be defined with caution......EXAMPLE..New-MpPerformanceRecording -RecordTo:.\Defender-scans.etl....#>..function New-MpPerformanceRecording {.. [CmdletBinding(DefaultPara

C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpPerformanceRecording.wprp

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	4971
Entropy (8bit):	4.542570045638256
Encrypted:	false
SSDEEP:	96:aAPEP3EPGEPJuDhDEMTRBTCq6IQEPvAwWSJNLKI+EPZMhkvyXHkJi2eEPZMUkvy/:aAcPUPpPJfMTRBTr6ILPvAwW6NRPZMh2
MD5:	990729AD92C1325C42B04BC975ECBD57
SHA1:	1CDBE901753CCE8D933DF8D50507CE16A25AA428
SHA-256:	E796454FEE4CF17EFDC25DB5FEEF00A5D7C1B335E6C4B4FE996E8AD7CAB01BC8
SHA-512:	EA0BCD6122068DA9412E5195C7AA3017C187790C790197AC5AF129F3ACF6C23780169C0165627E5C55CB3B99E6931CB18A42E61701C647FF07EAF6DA2740DAEB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8" standalone='yes'?>..<WindowsPerformanceRecorder Version="1.0" Author="Microsoft Defender for Endpoint" Team="Microsoft Defender for Endpoint" Comments="Microsoft Defender for Endpoint Scan performance tracing" Company="Microsoft Corporation" Copyright="Microsoft Corporation">. <Profiles>. System Providers -->.. <SystemProvider Id="SystemProvider_Scans_Light">. <Keywords>. <Keyword Value="CpuConfig" />. <Keyword Value="ProcessThread" />. <Keyword Value="ProcessCounter" />. </Keywords>. </SystemProvider>.. <SystemProvider Id="SystemProvider_Scans_Verbose" Base="SystemProvider_Scans_Light">. <Keywords Operation="Add">. <Keyword Value="Loader" />. <Keyword Value="SampledProfile"/>. </Keywords>. <Stacks>. <Stack Value="SampledProfile"/>. </Stacks>. </Syste

C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpPerformanceReport.Format.ps1xml

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	89221
Entropy (8bit):	4.361229755782801
Encrypted:	false
SSDEEP:	1536:RBjnDWhwL/L8LSLxLnLULsLxLpLVLlNfbjwSHZXX:DnDWh+Da4NLSqNlhlFbjpX
MD5:	888DF0473F17D5D2A301282D4DCD00E1
SHA1:	56AC68A398744B1CC0C1DA23CD8A32248A15C1AF
SHA-256:	40C471AD71C017CA08C7B76EEA892ADAFFF6C190AE31A350BEF3599D45D197B0
SHA-512:	0ADF3C5EAED961DCA08DF7ED606DBB20F381377BD8513DC14DE98265D527440DBEFA1883090AD39F7209EBC6D2A0C3B22D10492582AF13CF3858A29BA0E38DF3
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Configuration>.. <ViewDefinitions>.. <View>.. <Name>default</Name>.. <ViewSelectedBy>.. <TypeName>MpPerformanceReport.Result</TypeName>.. <TypeName>Deserialized.MpPerformanceReport.Result</TypeName>.. </ViewSelectedBy>.. <CustomControl>.. <CustomEntries>.. <CustomEntry>.. <CustomItem>.. <ExpressionBinding>.. <PropertyName>Overview</PropertyName>.. <ItemSelectionCondition>.. <ScriptBlock>($_ \| gm -Name:'Overview' -MemberType:NoteProperty).Count -gt 0</ScriptBlock>.. </ItemSelectionCondition>.. <CustomControl>.. <CustomEntries>.. <CustomEntry>.. <CustomItem>.. <NewLine />.. <Text>Overview</Text>.. <NewLine />.. <Text>========</Text>..

C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpPreference.cdxml

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	148504
Entropy (8bit):	4.003799857476438
Encrypted:	false
SSDEEP:	768:5oXNS+K2OPMqoVYeUDoj8c09uvo3dB91jox/QMzekHN+zg/1Qz/gD:5aNS+KBMqeYeUDzRNf1joxNHw2
MD5:	D5C7E1BB8479D7E3492E32994F72B78E
SHA1:	0DFCC58C2DEFA0583C1E22D77DFF49BDA6862F2A
SHA-256:	807837F5959D25896C9F366C3AD4C82A25C3818A64628A6534F7EAA50BC0D360
SHA-512:	E7A84A5797373C030F648668CC8A6EA4C3F332B0288BB122BEC6E07CD685299D10078C0492DA758581F224DC25660B71F1835FFF1D6D807EB3C9B16589274876
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<PowerShellMetadata xmlns="http://schemas.microsoft.com/cmdlets-over-objects/2009/11">.. <Class ClassName="root\Microsoft\Windows\Defender\MSFT_MpPreference" ClassVersion="1.0">.. <Version>1.0</Version>.. <DefaultNoun>MpPreference</DefaultNoun>.. <InstanceCmdlets>.. <GetCmdletParameters DefaultCmdletParameterSet="DefaultSet">.. </GetCmdletParameters>.. </InstanceCmdlets>.... <StaticCmdlets>.. <Cmdlet>.. <CmdletMetadata Verb="Set" />.. <Method MethodName="Set">.. <ReturnValue>.. <Type PSType="System.Int32" />.. <CmdletOutputMetadata>.. <ErrorCode />.. </CmdletOutputMetadata>.. </ReturnValue>.. <Parameters>.. <Parameter ParameterName="ExclusionPath">..

C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpRollback.cdxml

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	16622
Entropy (8bit):	5.999442568035114
Encrypted:	false
SSDEEP:	384:iSD3Dna50bJ63v4xmqORkhdB9rka8fCbOcTIcoQMzOqkHN+KaJqHcIAKz/kGfUoS:i/09uvo3dB9rjQsOjXQMz5kHN+zgvAKW
MD5:	035874B8BC819541FCAF5E2BBB6E30CD
SHA1:	7C72A3BB859B01635C4223BA1455E06984D7B35B
SHA-256:	962DA11E426A0C176538178D4CB3AC3BBEC6E5F1F5EF09FA41D15E415F7F66E3
SHA-512:	CB0B04CCF7A7AA13EB1D6FA4191C0D826C3C02AF6174244493F15E8ABA7F82FC1CF839ED311E81895CF913120D89E8AA8A752921867DB932C6318BB7CAEAB978
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<PowerShellMetadata xmlns="http://schemas.microsoft.com/cmdlets-over-objects/2009/11">.. <Class ClassName="ROOT\Microsoft\Windows\Defender\MSFT_MpRollback" ClassVersion="1.0">.. <Version>1.0</Version>.. <DefaultNoun>MpRollback</DefaultNoun>.. <StaticCmdlets>.. <Cmdlet>.. <CmdletMetadata Verb="Start" />.. <Method MethodName="Start">.. <ReturnValue>.. <Type PSType="System.Int32" />.. <CmdletOutputMetadata>.. <ErrorCode />.. </CmdletOutputMetadata>.. </ReturnValue>.. <Parameters>.. <Parameter ParameterName="Engine">.. <Type PSType="switch" />.. <CmdletParameterMetadata>.. <ValidateNotNull />.. <ValidateNotNullOrEmpty />.. </CmdletParameterMetadata>.. </Parameter>.. <Parameter ParameterName="Platform">.. <Type PSType="switch" />..

C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpScan.cdxml

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	17145
Entropy (8bit):	5.995518423679218
Encrypted:	false
SSDEEP:	384:7DORD5N4t50bJ63v4xmqORkhdB9Jka/Wu/QMzekHN+KaJqHckYAQz/TA2Pi:B09uvo3dB9JjuwQMzekHN+zg/1Qz/W
MD5:	6779DB15468D975E85CEF5F1CD8A832D
SHA1:	3FB476E7AAFDF2E23D81013AF6CFED3597E18BA6
SHA-256:	4E67DFB0B37A4C068891B6D83315DDA9EE41132A4649234DD91FEFA7FB7C24E8
SHA-512:	15C24D46155C483690321D51EC1CEADCE5FF9E0C547175AD18F033AC59584955B05FCB9184F3F36209701DBF5C2A6D11C4CCA8C8AF22F87CA19008CFEBD31E9B
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<PowerShellMetadata xmlns="http://schemas.microsoft.com/cmdlets-over-objects/2009/11">.. <Class ClassName="ROOT\Microsoft\Windows\Defender\MSFT_MpScan" ClassVersion="1.0">.. <Version>1.0</Version>.. <DefaultNoun>MpScan</DefaultNoun>.. <StaticCmdlets>.. <Cmdlet>.. <CmdletMetadata Verb="Start" />.. <Method MethodName="Start">.. <ReturnValue>.. <Type PSType="System.Int32" />.. <CmdletOutputMetadata>.. <ErrorCode />.. </CmdletOutputMetadata>.. </ReturnValue>.. <Parameters>.. <Parameter ParameterName="ScanPath">.. <Type PSType="System.String" />.. <CmdletParameterMetadata>.. <ValidateNotNull />.. <ValidateNotNullOrEmpty />.. </CmdletParameterMetadata>.. </Parameter>.. <Parameter ParameterName="ScanType">.. <Type PSType="MpScan.ScanType

C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpSignature.cdxml

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	17129
Entropy (8bit):	5.995911311443287
Encrypted:	false
SSDEEP:	384:E6D5YR4R50bJ63v4xmqORkhdB9/kaDW2WQMziCkHN+KaJqHck7+z/m2q/j:T09uvo3dB9/jKbQMziCkHN+zg/7+z/Oj
MD5:	CA4FC184FD7EFB9A4D2297795C2139D5
SHA1:	8EEA01A98017C22DBE6D6772BBCF41A501260AEF
SHA-256:	D939C81CBA293CFA02E577821BE05D6A9B1D2F77287B014912A209850ECE627C
SHA-512:	B28D5C9E7E2DCE44C18A1BDA3ED07D0D063954E86122A4854DC5051D8462EFE633AD9F0884CB726AFE937C8A2DE7FA8ED9B7090F9ADD223A61020DE80EF6FE4B
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<PowerShellMetadata xmlns="http://schemas.microsoft.com/cmdlets-over-objects/2009/11">.. <Class ClassName="ROOT\Microsoft\Windows\Defender\MSFT_MpSignature" ClassVersion="1.0">.. <Version>1.0</Version>.. <DefaultNoun>MpSignature</DefaultNoun>.. <StaticCmdlets>.. <Cmdlet>.. <CmdletMetadata Verb="Update" />.. <Method MethodName="Update">.. <ReturnValue>.. <Type PSType="System.Int32" />.. <CmdletOutputMetadata>.. <ErrorCode />.. </CmdletOutputMetadata>.. </ReturnValue>.. <Parameters>.. <Parameter ParameterName="UpdateSource">.. <Type PSType="MpSignature.UpdateSource" />.. <CmdletParameterMetadata>.. <AllowEmptyString />.. <AllowNull />.. <ValidateNotNull />.. <ValidateNotNullOrEmpty />.. <ValidateSet>.. <AllowedValue>In

C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpThreat.cdxml

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	16755
Entropy (8bit):	5.987433812294068
Encrypted:	false
SSDEEP:	384:Te50bJ63v4xmqORkhdB94kavWg/QMzekHN+KaJqHckYAQz/TAFILfk0jI:m09uvo3dB94jeGQMzekHN+zg/1Qz/zfU
MD5:	AFED2BF4A56F4495532779C18ABCEA63
SHA1:	EC4211AB2A909570E006A2752580935A681FBBBC
SHA-256:	5F7088B26FDE7459E01E6853A1D98FAA8189E3406A73393114291E2E9B801B23
SHA-512:	04CA5D13C2088B27ABF39EB4E1A4DE2A0E1663185A0F234B89B07F66D707BA05CA00C8D1512241154240C1E57234D0F19A5482E73F92593A4D30BCF519AEC3C2
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<PowerShellMetadata xmlns="http://schemas.microsoft.com/cmdlets-over-objects/2009/11">.. <Class ClassName="ROOT\Microsoft\Windows\Defender\MSFT_MpThreat" ClassVersion="1.0">.. <Version>1.0</Version>.. <DefaultNoun>MpThreat</DefaultNoun>.. <InstanceCmdlets>.. <GetCmdletParameters DefaultCmdletParameterSet="DefaultSet">.. <QueryableProperties>.. <Property PropertyName="ThreatID">.. <Type PSType="int64" />.. <RegularQuery>.. <CmdletParameterMetadata IsMandatory="false" Aliases="ID".. CmdletParameterSets="ById" />.. </RegularQuery>.. </Property>.. </QueryableProperties>.. </GetCmdletParameters>.. </InstanceCmdlets>.. <StaticCmdlets>.. <Cmdlet>.. <CmdletMetadata Verb="Remov

C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpThreatCatalog.cdxml

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	16257
Entropy (8bit):	6.0043558997855655
Encrypted:	false
SSDEEP:	384:350bJ63v4xmqORkhdB9nkauuopWIQbHQMzs5kHN+KaJqHckPGHz/Nxi9qdxheC:p09uvo3dB9njuUFHQMzckHN+zg/PGHz/
MD5:	3A74C67AB3681789E7E98AF33E38AA60
SHA1:	E52104B5361CBE50E6B6C67F0C4C8BF565B01827
SHA-256:	D0994E5219741DA2FFFFD2844168F19B8FEC3348831B5EE1D032A678DC4FF536
SHA-512:	D023075FA1C7E87BC141D97D106A9AE480E5A08979F85A0343BC12D1BC259891C918BFE31A4198741E19A9E0A5E8EC5F50C477713675EE474B55142486F6A195
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<PowerShellMetadata xmlns="http://schemas.microsoft.com/cmdlets-over-objects/2009/11">.. <Class ClassName="ROOT\Microsoft\Windows\Defender\MSFT_MpThreatCatalog" ClassVersion="1.0">.. <Version>1.0</Version>.. <DefaultNoun>MpThreatCatalog</DefaultNoun>.. <InstanceCmdlets>.. <GetCmdletParameters DefaultCmdletParameterSet="DefaultSet">.. <QueryableProperties>.. <Property PropertyName="ThreatID">.. <Type PSType="int64" />.. <RegularQuery>.. <CmdletParameterMetadata IsMandatory="false" Aliases="ID".. CmdletParameterSets="ById" />.. </RegularQuery>.. </Property>.. </QueryableProperties>.. </GetCmdletParameters>.. </InstanceCmdlets>.. </Class>..</PowerShellMetadata>.. SIG # Begin signature block -->.. MIImFAYJKoZIhvcNAQcCoI

C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpThreatDetection.cdxml

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	16245
Entropy (8bit):	6.006537583545973
Encrypted:	false
SSDEEP:	384:W50bJ63v4xmqORkhdB9bkaDHbbkp9QMz4o9kHN+KaJqHcIYRWz/6nrNyF+:S09uvo3dB9bjbXK9QMzt9kHN+zgvkWzG
MD5:	77E569C0B10D5A1AFAECC5629F4F6A8B
SHA1:	019B9D038AE2A9127ACB87D4C6C546A4DC76A3E7
SHA-256:	07ED2EAB80ED40FF30A50AACAA363FE895F29BF128F1FACC242EF0F02699E559
SHA-512:	E023DC249AF751208040CDD2C665154B0B059BEC227300A557DA213AEE088472545AA673CF6E745BDDE467711D2DDF12D5F6895A2EC1D9A369256AD4F9612D1C
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<PowerShellMetadata xmlns="http://schemas.microsoft.com/cmdlets-over-objects/2009/11">.. <Class ClassName="ROOT\Microsoft\Windows\Defender\MSFT_MpThreatDetection" ClassVersion="1.0">.. <Version>1.0</Version>.. <DefaultNoun>MpThreatDetection</DefaultNoun>.. <InstanceCmdlets>.. <GetCmdletParameters DefaultCmdletParameterSet="DefaultSet">.. <QueryableProperties>.. <Property PropertyName="ThreatID">.. <Type PSType="int64" />.. <RegularQuery>.. <CmdletParameterMetadata IsMandatory="false" Aliases="ID".. CmdletParameterSets="ById" />.. </RegularQuery>.. </Property>.. </QueryableProperties>.. </GetCmdletParameters>.. </InstanceCmdlets>.. </Class>..</PowerShellMetadata>.. SIG # Begin signature block -->.. MIImEQYJKoZIhvcNAQcCoIImAjCCJf

C:\Program Files\Statistical Flexibility\Powershell\MSFT_MpWDOScan.cdxml

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	16024
Entropy (8bit):	6.008066151210556
Encrypted:	false
SSDEEP:	384:L150bJ63v4xmqORkhdB9wka5XbXQDQMz4kHN+KaJqHcIuaz/vlC:n09uvo3dB9wj5rSQMz4kHN+zgvuaz/vc
MD5:	845144742FD32A3D3E92320EC9D39AEB
SHA1:	5C2B4697952D9A95DD1CB95BE982D92C6235F413
SHA-256:	CC2AA9B4DF712212D1A0C7714C6528C9881A8ED7C31758CE7F356FE579F7C69E
SHA-512:	0C1BD8F578FBE91694A2CBF986D95646D8DBD46D5AB898863289EB0D92B0695CEBE5F493835BCC6A8D3F041F9069003DB53B3027663EBEA736343BD88C5D65FE
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<PowerShellMetadata xmlns="http://schemas.microsoft.com/cmdlets-over-objects/2009/11">.. <Class ClassName="ROOT\Microsoft\Windows\Defender\MSFT_MpWDOScan" ClassVersion="1.0">.. <Version>1.0</Version>.. <DefaultNoun>MpWDOScan</DefaultNoun>.. <StaticCmdlets>.. <Cmdlet>.. <CmdletMetadata Verb="Start" />.. <Method MethodName="Start">.. <ReturnValue>.. <Type PSType="System.Int32" />.. <CmdletOutputMetadata>.. <ErrorCode />.. </CmdletOutputMetadata>.. </ReturnValue> .. </Method>.. </Cmdlet>.. </StaticCmdlets>.. </Class> ..</PowerShellMetadata>.. SIG # Begin signature block -->.. MIImEQYJKoZIhvcNAQcCoIImAjCCJf4CAQExDzANBglghkgBZQMEAgEFADB5Bgor -->.. BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG -->.. KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCBzAXdbBfjvkCEN -->.. qK7Ym3r0lwef2vQhN9zidTDdkf

C:\Program Files\Statistical Flexibility\ProtectionManagement.dll

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	808344
Entropy (8bit):	6.016400786610223
Encrypted:	false
SSDEEP:	12288:N6s0gncuFlYzp2KRnHwSlKCLArnis4FwdWFUDUAX:N6sH5otNnHJlbfs4QRX
MD5:	B92905FE235F0367E18C893CFD2DB09E
SHA1:	70C703DCF0A24293D6845A7CF05269A276B74363
SHA-256:	995189A1262AB1912EED6A7246A0CD677C927B26F1B65634F31141AEB7DDA828
SHA-512:	7A276A1F3BD1BB541950BFE969C6324642DD8439A1341761E5466CAFF9F6C7B9CE370FE33DC6FC7ABC40299862C462E7B7C7D2026807E466A326C30F4AC40BFD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........P.......................................s..................................M.....m...........Rich...........................PE..d...Z.wi.........." ...&.....P...............................................P......L.....`A.................................................................p..HT...0...%.......T......p.......................(... "..@...................,........................text............................... ..`.rdata..............................@..@.data...4...........................@....pdata..HT...p...`...P..............@..@.didat..............................@....rsrc...............................@..@.reloc...T.......`..................@..B........................................................................................................................................................................................

C:\Program Files\Statistical Flexibility\ProtectionManagement.mof

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	C source, Unicode text, UTF-16, little-endian text, with very long lines (6567), with CRLF line terminators
Category:	dropped
Size (bytes):	121102
Entropy (8bit):	3.5901159089837003
Encrypted:	false
SSDEEP:	768:fQ9DJczDQnjhFenybYe+yZyQ9DJczDQnjhFenybYe+yZg:Wjv+yLjv+ya
MD5:	7FC36914207D051C1F4076562ECBE638
SHA1:	B6283D37C27E8C2B9383B66B1119F15AA92B55FD
SHA-256:	8DB369D8256B96FD39213CD9D8642AC736CC63555FD399428DD81403D40BAC1E
SHA-512:	98FB91D83EC3F56FF76C6E0FE3A478AC02AFEFCA3A4ED51D1CEF6A1242228917820E9933B67FFF679A72405AED0A76B212AE3AC93CA4C29E7EF8D834523E1C16
Malicious:	false
Preview:	..#.p.r.a.g.m.a. .a.u.t.o.r.e.c.o.v.e.r.....#.p.r.a.g.m.a. .n.a.m.e.s.p.a.c.e.(.".\.\.\.\...\.\.r.o.o.t.\.\.M.i.c.r.o.s.o.f.t.\.\.W.i.n.d.o.w.s.\.\.D.e.f.e.n.d.e.r.".).........I.n.s.t.a.n.c.e. .o.f. ._._.W.i.n.3.2.P.r.o.v.i.d.e.r. .a.s. .$.p.r.o.v.....{..... . .N.a.m.e. .=. .".P.r.o.t.e.c.t.i.o.n.M.a.n.a.g.e.m.e.n.t.".;..... . .C.l.s.I.d. .=. .".{.A.7.C.4.5.2.E.F.-.8.E.9.F.-.4.2.E.B.-.9.F.2.B.-.2.4.5.6.1.3.C.A.0.D.C.9.}.".;..... . .I.m.p.e.r.s.o.n.a.t.i.o.n.L.e.v.e.l. .=. .1.;..... . .H.o.s.t.i.n.g.M.o.d.e.l. .=. .".L.o.c.a.l.S.e.r.v.i.c.e.H.o.s.t.".;..... . .v.e.r.s.i.o.n. .=. .1.0.7.3.7.4.1.8.2.5.;.....}.;.........I.n.s.t.a.n.c.e. .o.f. ._._.M.e.t.h.o.d.P.r.o.v.i.d.e.r.R.e.g.i.s.t.r.a.t.i.o.n.....{..... . .P.r.o.v.i.d.e.r. .=. .$.p.r.o.v.;.....}.;.........I.n.s.t.a.n.c.e. .o.f. ._._.E.v.e.n.t.P.r.o.v.i.d.e.r.R.e.g.i.s.t.r.a.t.i.o.n.....{..... . .P.r.o.v.i.d.e.r. .=. .$.p.r.o.v.;..... . .e.v.e.n.t.Q.u.e.r.y.L.i.s.t. .=. .{.".s.e.l.e.c.t. .*. .f.r.o.m. .M.S.F.T._.M.p.E.v.e.n.t.".}.;...

C:\Program Files\Statistical Flexibility\ProtectionManagement_Uninstall.mof

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	C source, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2664
Entropy (8bit):	3.464075447819169
Encrypted:	false
SSDEEP:	24:QXbclfUWvlDQzj3WvlDQzCWvlDQzwNWvlDQzYTYWvlDQzSJjWvlDQzfWvlDQzyWU:eTjDGwJ3SJnr24RFZ7a2la2Sa2mWaWP
MD5:	C4E26C53F76774E091FEE17FFFF64414
SHA1:	5CB3AD07CF6DFF3DB5BAAD55488A769A664BC093
SHA-256:	5172863C41E84024799B2034D42F10E9720FC53171A4F6C1CA2FDB2C6F71DFE9
SHA-512:	635DE182629A248B9BF3061E1A1C1D3ED904B8843187B64CEB3BF96DD4B10769D9E001EAEECED2179350F7012C82317B2C833A8501FF9C92D1A0CE94C711FEBB
Malicious:	false
Preview:	..#.p.r.a.g.m.a. .n.a.m.e.s.p.a.c.e. .(. .".\.\.\.\...\.\.r.o.o.t.\.\.M.i.c.r.o.s.o.f.t.\.\.W.i.n.d.o.w.s.\.\.D.e.f.e.n.d.e.r.".).........#.p.r.a.g.m.a. .d.e.l.e.t.e.c.l.a.s.s.(.".M.S.F.T._.M.p.C.o.m.p.u.t.e.r.S.t.a.t.u.s.".,.n.o.f.a.i.l.).....#.p.r.a.g.m.a. .d.e.l.e.t.e.c.l.a.s.s.(.".M.S.F.T._.M.p.E.v.e.n.t.".,.n.o.f.a.i.l.).....#.p.r.a.g.m.a. .d.e.l.e.t.e.c.l.a.s.s.(.".M.S.F.T._.M.p.H.e.a.r.t.B.e.a.t.".,.n.o.f.a.i.l.).....#.p.r.a.g.m.a. .d.e.l.e.t.e.c.l.a.s.s.(.".M.S.F.T._.M.p.P.r.e.f.e.r.e.n.c.e.".,.n.o.f.a.i.l.).....#.p.r.a.g.m.a. .d.e.l.e.t.e.c.l.a.s.s.(.".M.S.F.T._.M.p.R.o.l.l.b.a.c.k.".,.n.o.f.a.i.l.).....#.p.r.a.g.m.a. .d.e.l.e.t.e.c.l.a.s.s.(.".M.S.F.T._.M.p.S.c.a.n.".,.n.o.f.a.i.l.).....#.p.r.a.g.m.a. .d.e.l.e.t.e.c.l.a.s.s.(.".M.S.F.T._.M.p.S.i.g.n.a.t.u.r.e.".,.n.o.f.a.i.l.).....#.p.r.a.g.m.a. .d.e.l.e.t.e.c.l.a.s.s.(.".M.S.F.T._.M.p.T.h.r.e.a.t.".,.n.o.f.a.i.l.).....#.p.r.a.g.m.a. .d.e.l.e.t.e.c.l.a.s.s.(.".M.S.F.T._.M.p.T.h.r.e.a.t.C.a.t.a.l.o.g.".,.n.o.f.a.i.l.).....#.p.

C:\Program Files\Statistical Flexibility\ThirdPartyNotices.txt

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6717
Entropy (8bit):	5.162252158398129
Encrypted:	false
SSDEEP:	96:+WRspYDLPkQHFom1DW4DlHFposoSKYax9gDCk4Cp1PRsQHdBLe:DaVQHFB0AlHISKYoopoQHdxe
MD5:	CE7313760386B6ABDE405F9B9E6EA51D
SHA1:	F969931AC45991F7ECB6767A69433A7082ECCA2F
SHA-256:	73E26404B3571A9E859B3A1144F54C353172479586E0A23C3A7DDA0C1C0AE919
SHA-512:	CF990FC05FD3ED78FF35F1A1ACD5317626D46745BF7E4F8C62AA068A587ABF52F232080464F82692A2BB8C04A4FFA53599B933A4281BC7E697337720DB65BF29
Malicious:	false
Preview:	===============================================================================..1. C++ REST SDK (https://github.com/Microsoft/cpprestsdk).... C++ REST SDK ....The MIT License (MIT)....Copyright (c) Microsoft Corporation....All rights reserved.....Permission is hereby granted, free of charge, to any person obtaining a copy of..this software and associated documentation files (the "Software"), to deal in..the Software without restriction, including without limitation the rights to..use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of..the Software, and to permit persons to whom the Software is furnished to do so,..subject to the following conditions:....The above copyright notice and this permission notice shall be included in all..copies or substantial portions of the Software.....THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR..IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,..FITNESS FOR A PARTICULAR PURPO

C:\Program Files\Statistical Flexibility\com.microsoft.defender.be.chrome.json

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	411
Entropy (8bit):	4.813059973872471
Encrypted:	false
SSDEEP:	6:3HWSjKNde/Ott+dmvVnEuLrORVCqwvFFaFlLulkNCB+SrxxLxeNCWHyLjNCs9V8I:L2kO+WnEeMOUlLAjB/1N/kSUVo
MD5:	36CA2812EE9B49E0785121434B7DD136
SHA1:	CD82C099B0ADB4496E7D30951F249EB7CEBE7570
SHA-256:	8602FABA22D8E06CCB146707B4A10F6256799FFE854D37781156A5A6D6120369
SHA-512:	FEC9E030855BDEA38345E3E0723E955D4BC40A642A0BE139ACEF7F25784058DC4D6A2F73FC9A3155776D542B4D1BDAC0F1F0CEB71CF8A2C6BA91B52EEF1DF3CB
Malicious:	false
Preview:	{.. "name": "com.microsoft.defender.browser_extension.native_message_host",.. "description": "Native host for Microsoft Defender Browser Extension",.. "path": "mpextms.exe",.. "type": "stdio",.. "allowed_origins": [.. "chrome-extension://echcggldkblhodogklpincgchnpgcdco/",.. "chrome-extension://lcmcgbabdcbngcbcfabdncmoppkajglo/",.. "chrome-extension://nhepdlojobjcnniaggfkkgeekccgmaji/".. ]..}

C:\Program Files\Statistical Flexibility\com.microsoft.defender.be.firefox.json

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	310
Entropy (8bit):	4.6057944418368315
Encrypted:	false
SSDEEP:	6:3HWSjKNde/Ott+dmvVnEuLrORVCqwvFFaF1plqejKrG+9Cyo:L2kO+WnEeMOU1rqe1+4yo
MD5:	7797BB3399C837EDB0F7564D6E3C6217
SHA1:	241F5E9FCE639E713E50FE748B5865F6EC2880C0
SHA-256:	E2A0B5B4F64653C86B71231EB3FF5ABED56B4180C90234DE2C008456E270F8E3
SHA-512:	004FD5CA6FF7EA9A8732A078493AD8650D1C5EBE7F90287ABF28E4FE561592C83E949BA0626FB97F31E3F0ACFC3974FD59891BF49B723B16A7B39DF1E29195A7
Malicious:	false
Preview:	{.. "name": "com.microsoft.defender.browser_extension.native_message_host",.. "description": "Native host for Microsoft Defender Browser Extension",.. "path": "mpextms.exe",.. "type": "stdio",.. "allowed_extensions": [.. "microsoft.defender.browser_extension.native_message_host@microsoft.com".. ]..}

C:\Program Files\Statistical Flexibility\dllhost2.exe

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2136112
Entropy (8bit):	7.1126043895709525
Encrypted:	false
SSDEEP:	49152:/MxaPT8T092BhFPF878x0I8bqlPl12D7kZg8r37UnMZ0CBefF0:Lr8T092Tc78OhqZl12Huvr37H
MD5:	0CB241D901D121428DF1531B1F12A654
SHA1:	3882CDDEBED9E646EB4AAD9D65B3F9450617AD61
SHA-256:	B93D3EC71BC2D516B549E86FE5FB306A29805A6C4913C3AFA9138F2B263FCFB6
SHA-512:	2BD85073BAB10E32818C1A3FF0389733898ACB3E3656A0A1667EC18EBC67A4097BB682D06A41C051C97F326A6596D66696255231D224E7A22BA1C9B5D2552A15
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........r....N...N...N..O...N...O...N...O...N...O...N..O...N..O...N...N...N...N...N..O...N..Ow..N..N...N..O...NRich...N................PE..L...................................2............@...........................!.......!...@.................................0......... .H............. .0j.... .........T...................tP.......O..................,............................text... ........................... ..`.data...\...........................@....idata...+.......,..................@..@.rsrc...H..... .....................@..@.reloc........ ......:..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\Statistical Flexibility\en-EN\MpClient.dll

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25644409
Entropy (8bit):	1.8424864439208832
Encrypted:	false
SSDEEP:	196608:W0N2+VYsIbKq2EfA2eDNaY47Mbs1mZZY3GoeoOouX:We7/oeoE
MD5:	C1F7126FE6A95F0D08BBA62AD8CC6AFA
SHA1:	7D65E524505302CE0F24E7C1690E014D92F8D25F
SHA-256:	EECC503F79AC4347069875A7BAAD6FE3F0F7A835F38DC2CFE214A6D3643E7FA5
SHA-512:	051C3DBAE2F271F65D6B4AACCA1CF5F7FCA6762479392811E62B7F3DBA0E309DAED91F1B896D1B86DF0B03FDC06F3C318681213CDE6ED4BC5498C7D7BA4C40D6
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win64..$7........................................................................................................................................PE..d.....f.........." ......F...........F.......@...............................Z...................................... ................N.o ...@N..U....V.......R...............N.`...................................................0VN.(.....N.....................text...D.F.......F................. ..`.data....Y....G..Z....F.............@....bss....d....pM..........................idata...U...@N..V...VM.............@....didata......N.......M.............@....edata..o ....N.."....M.............@..@.rdata..D.....N.......M.............@..@.reloc..`.....N.......M.............@..B.pdata........R......hQ.............@..@.rsrc.........V......jU.............@..@..............Z.......Y.............@..@........................................

C:\Program Files\Statistical Flexibility\en-EN\MpDlpCmd.exe

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	393912
Entropy (8bit):	5.820930880165877
Encrypted:	false
SSDEEP:	6144:oHzOhG797kAulm7J+miTVVmVVV8VVNVVVcVVVxVVVPVVlVVVRVVVtVVWV60jVLVB:kzH7lkAtUAI
MD5:	2CDF80CE73859A3E62254F3A36ABFB94
SHA1:	BA9842A5E737B3D1FF3F5D5DA732F68CB22CBE80
SHA-256:	6C52CF381C697790A8FC05EE0A799329D80B249633ECB58D28AC3A37C5D2F27D
SHA-512:	E9B5F0D2EE2A47BF85C1B3292D788148ACAD1CF131B67A74BC8FF14A7335CE55B8F4911AB920713E015D590B4AFD5FF55208C7EFC3F1033E6592B7EC19735C38
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6..Or...r...r....C..p....C..s...!...b...{.k.`...!...@...!...~...!...g...r.../....C..!....C..s....C..s...Richr...................PE..d...'..:.........."....&............`..........@....................................Q................ ......................................lX..T...............<........2.......... ...p.......................(.......@............................................text............................... ..`.rdata.............................@..@.data........p.......p..............@....pdata..<........ ..................@..@.rsrc............ ..................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Program Files\Statistical Flexibility\mpextms.exe

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	910520
Entropy (8bit):	6.440665886952958
Encrypted:	false
SSDEEP:	12288:81MBDFFuqT5/L87Fy8+nz49KpuX6sDO8R80DelQgf/9P+x531p5176joofm9waKb:8MDFFL5zIAcpLm0yaKb
MD5:	016267BDC6740AFA3EC703410CB8CA5F
SHA1:	0DE528312F9E9B2F73BBD9A76D992926E87B4A49
SHA-256:	A53694CD695CDF6F3BF7111D0364A1B17656B9FD4E209C632363546DF25F608E
SHA-512:	73371162206B311E3A3B45362A50C580EC195C7A2FC45F0FD6016E129DBAD740E9C814649BCFF65D605F25878915E7400752358B20F95AB9958DC252CDD76BCC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................(...........................................(.......(+.....(.....Rich...........PE..d................"....&............P..........@..........................................`.......... .......................................u..........8.... ..0c.......D..........pb..p...................`P..(... O..@............P...............................text............................... ..`.rdata..............................@..@.data...0........p..................@....pdata..0c... ...p..................@..@.rsrc...8............p..............@..@.reloc........... ..................@..B........................................................................................................................................................................................................................................................................

C:\Program Files\Statistical Flexibility\pack01.zip

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	data
Category:	dropped
Size (bytes):	142
Entropy (8bit):	6.55447018279355
Encrypted:	false
SSDEEP:	3:DfVjzD2ZzXgE4dXC/FiYvyfgaPDlZqLDpVYngGbu/6Ry0s9rYdn:hnDEgRdSZEg8YDp1ERy0OAn
MD5:	57A37BD0840D0745A9481BCC25B5A792
SHA1:	E8B7C744981C0713DE5EBB308897EFCBD374FD11
SHA-256:	E2B2371F95D8D9CBFCA301AFF3441466E30453BBD37A42FA17DAF4D85AA7E627
SHA-512:	08AFA751874B49FB20ADBEC0C824609DAE0DECD6E747471EF8CB19FAE299A65D21ACC02185560669ED9E36CD74E2E4372B61E52EEF34D5785E9BBA3DC8FD431B
Malicious:	false
Preview:	H~.E.L......z.'.<.Er...a..]...`rf1_B..U.~.e)?...Ri..{.. X..ykq...&..(...Ri..G..08..<.Er...X}_.....V ....j..PK.o..'a#-.=D4...d......&.

C:\Program Files\Statistical Flexibility\part1.zip

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	data
Category:	dropped
Size (bytes):	10100704
Entropy (8bit):	7.999981703311507
Encrypted:	true
SSDEEP:	196608:ic5/xKCbd82qFvRrdkTSqpQwfuqqOCZz5Nshqp0AYZVtBU:VDbq5FvRrtoQUq1B5ZpgZ7BU
MD5:	771C3299D3691A50F11A487987120700
SHA1:	2FA5B9D0D6C4498E58D5B93450F998F938735CEB
SHA-256:	8827BAF7B1633C5BA32E385BCC77A801AD6093B365F48D84ABC6863554153737
SHA-512:	A397769825B42FDB75BFAFA0C67045EA1554AE845FDE4C7E1651DF2492AC0CF3B425A9BF6C41A89654AC9B55CA936E0B751F624E1ADED1ADF7E92B930D4579D4
Malicious:	false
Preview:	........i@Q.R..r%f.k]G..i.v..a!r...&.O......e..\..C....(.S...a.F.xt..i..EX0....^..= E....r..^$.lec.gS'2.Zo.....`e`L...1..8.tp%G....N.D..X.a.2.4..E.},....."......\..i.6....#R.5..h&...atp.&N....:.I..z?.YN.E..TH.........p.~.vn.J.+..,..n.0...rLX..1..7.=...m7\|.x...KX..P....I.^..6......,J.V..3,.V3. ...d..>.i.J[..~.).\....;.\|........4y..Gn...)tt.4d.....h..v..]....l\.W.Ozl7....b...L/T....ba.O.{.j?...\XH.-.r......y...G.IP.Y\|;....C....c...s..'.v.....j/`$... ....4.@u....sxJ...b.v.F-.I...rA..jv$.:i.....-....<............BV.{d...&.Um.K............~pzV..}.S....LV@J.zM.K..rg..=q......{.8..e...."..S.G...k+..0.H,2..&..jy....p.Q...q......G.3.1e7...(....d~\.1.]....#.....b..../7....T....!...W......}]......:.?..H.[.q,#1.....^.>=^....K..........w...:...q..71.e.......`.....A..%...Ad..!f\....xC.t...$.VIP.N.s....:\|l.;x.....m.]7...n#.".C#..^^.A..y..eU.._.?...f..6...w...-..A.hL.Q.k.i..2D...+,.....j..OO.Y53_.M.@8.").....'.>..v.W .j..5.j..9...A6..9NQk.

C:\Program Files\Statistical Flexibility\part1.zip.bin

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	10100693
Entropy (8bit):	7.994545817137766
Encrypted:	true
SSDEEP:	196608:A6ztxFprVKGUnJ7sbZQCYICL1oc2fq8YnvUdyyUEJ0HkvSebpwcjN:XzFVVKLsbZQhICLW3C83yyUE8cx
MD5:	68E62141F7531A8BBFD1A319C0606860
SHA1:	309755F1256F31F9CD8DF49FC5929D90EB6CF84B
SHA-256:	4FC6E48EB4AA557DD3C41B0F2AA245392527096B64AA358DBF212C29AAD13AAD
SHA-512:	F332922753F221CB2D2418CE8596B8A6C2405D174776F99A203009A858CC9453145C920680B05D86A72DD014D4C11EDDF387B6EC1FE8750F8051E1C3D75BC5C7
Malicious:	false
Preview:	PK...........Xj.M.....=.......ThirdPartyNotices.txt.XmO.H..n....V:...`....Lb..!.b3,.N.....}..d.....v.0.....BDnWUWuW=.r...m.....W..a.a....E..;:..b^N.X..nD.....(.s.u......mVZ...n..."../..+...y.....%BW.\V......`.4.F\}.K.#..Bk...a....`.XV........9S3.@!.e+... '....f. F5...9.!..Lq.N.i-c.P $2..<+.Z0.)._.i{a.w`vI8KAd$.C...xt.,.B...8H..eBZ4.S.....^.]H.5w...,d"...ey9I..;...=).\.h..!K.....$..ks7..".>.C-.c..a9....OiZ....'.xj.m.x\...Oe..%Y..,.d...q.6..9.k..d..VZ.5..?.9C.'.>5.Zd.K....j].....\*.%9A[}.;....2...>.!...A.........wAt=...).. ...%x.{.#.........0..Vp3..>...n.........Ct..}..FC..kY........W."...=..e..H..p....q.to...F...0.Q.......1n......mq.........^.6.h..T..pt?...#...{>.^...w.....n..n..y7.o..(......pw......_7.....;.Dc\|u..q...B..o..t&.....Hg.,C#...~%.....e86....=............}...'.x.....@..q..a..q..Za.(...@.0.1...+.C...w....I....J.5.'Pf.W&B.....op.#W&.O.N.u.....WBV...[Q.....].....</(DQ.<.,.+.4;.r.J.}-....".I...1.....r.t...jvT..>..].....uc.m.hM..Ph2....R

C:\Program Files\Statistical Flexibility\pt-BR\MpAsDesc.dll.mui

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	67480
Entropy (8bit):	4.307809209829941
Encrypted:	false
SSDEEP:	768:xI6IoHwex9cxMtOkAK+FKFKIlEhd1PYl9zw7:8ex2WtOhK+oPlEhLPY3zw7
MD5:	8A9B719A51CAAD9B1527EAB05E20883F
SHA1:	7B4D588855AA1BF116CB473DEEBC9D57D26C400C
SHA-256:	F62190490EB2B39EB273E836858EF107F3D642BA190F49B3EE9F29BA6E0000AD
SHA-512:	18C216BA54631393454B5F18D6E50190C17D79042899850E9E7ACCA75E1107BC4B8E66FE66C97B719944DB8B6B01F6A1408DF9E654487EE3BFC11A3182F66BAF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X=..9S..9S..9S......9S...Q..9S.Rich.9S.........PE..L..................!...&..................................................................@.......................................... ...................%..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@...............o........l...P...P..........o........$...........................................8....rdata..8........rdata$voltmd...P........rdata$zzzdbg.... ..0....rsrc$01....0(.......rsrc$02.... ......oe.u^(...Gd...m..F....a-...o........................................................................................................................................................................................................................................................................

C:\Program Files\Statistical Flexibility\pt-BR\MpClient.dll

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	28035733
Entropy (8bit):	1.7076044039416933
Encrypted:	false
SSDEEP:	49152:RxZpshNlgPo3Gmh+dmgEXI3opBZUOSAnlrkXersaYzQ5QF5oeoTTSXHX1P:bZU8dmVX4kJMzFoeoyH1
MD5:	F4C9AA398A861B5AB07889A38D62F0AF
SHA1:	1A8BE26D4F99918D64B6BDBDBE0EF052B26833D7
SHA-256:	92395B0EA05BAF1E929CC16B4D0AACF740757470D393797B5756B006DB64322E
SHA-512:	7278258AB989B31DCB615B7205691CC56C4C7D93D849E3FCEDF2B21D8F5A705BA0D022CB8A0CBA0A247E65F2C09703474FFB256812448F90FFB12D8A1B36910B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win64..$7........................................................................................................................................PE..d....~.f.........." ......F...........F.......@...............................Z...................................... ................N.o ...@N..V....V.......R...............N.....................................................PVN.H.....N.....................text...$.F.......F................. ..`.data...8\....G..^....G.............@....bss....l....pM..........................idata...V...@N..X...^M.............@....didata......N.......M.............@....edata..o ....N.."....M.............@..@.rdata..D.....N.......M.............@..@.reloc........N.......M.............@..B.pdata........R......rQ.............@..@.rsrc.........V......tU.............@..@..............Z.......Y.............@..@........................................

C:\Program Files\Statistical Flexibility\pt-BR\MpDlpCmd2.exe

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	393912
Entropy (8bit):	5.820930880165877
Encrypted:	false
SSDEEP:	6144:oHzOhG797kAulm7J+miTVVmVVV8VVNVVVcVVVxVVVPVVlVVVRVVVtVVWV60jVLVB:kzH7lkAtUAI
MD5:	2CDF80CE73859A3E62254F3A36ABFB94
SHA1:	BA9842A5E737B3D1FF3F5D5DA732F68CB22CBE80
SHA-256:	6C52CF381C697790A8FC05EE0A799329D80B249633ECB58D28AC3A37C5D2F27D
SHA-512:	E9B5F0D2EE2A47BF85C1B3292D788148ACAD1CF131B67A74BC8FF14A7335CE55B8F4911AB920713E015D590B4AFD5FF55208C7EFC3F1033E6592B7EC19735C38
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6..Or...r...r....C..p....C..s...!...b...{.k.`...!...@...!...~...!...g...r.../....C..!....C..s....C..s...Richr...................PE..d...'..:.........."....&............`..........@....................................Q................ ......................................lX..T...............<........2.......... ...p.......................(.......@............................................text............................... ..`.rdata.............................@..@.data........p.......p..............@....pdata..<........ ..................@..@.rsrc............ ..................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Program Files\Statistical Flexibility\pt-BR\MpEvMsg.dll.mui

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	58264
Entropy (8bit):	4.532474765479815
Encrypted:	false
SSDEEP:	384:h9SmktkGrXi8FdOUry+KoK2o4XqPA/UDBTQXmQZoiKEu8+kuoYWROdDBRJ/Sx9R0:hY5t0YJ7Od1Pa59zm
MD5:	7BB8BB260ECA922B6F321509B933D496
SHA1:	F0F1CF5EEBC89D1AC76EC81797277EBAD767871A
SHA-256:	E2A786A2A43DF5CA7FCC7E172B73FC60243FE2D67E8209804602A3DDE8453E73
SHA-512:	DD1E7BE76FC6A7C708114819B36B3777D8751804861A897F302F2184523DDC2349FC9304F291AF01DC85D000883473A76AB1C16B449E64649915058D30BA4D2A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X=..9S..9S..9S......9S...Q..9S.Rich.9S.........PE..L..................!...&............................................................\.....@.......................................... ...................%..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@............%.v.........l...P...P.......%.v.........$...........................................8....rdata..8........rdata$voltmd...P........rdata$zzzdbg.... .......rsrc$01..... ..`....rsrc$02.... .....B.91Q\.rVe.....r..0S..W1%.v.........................................................................................................................................................................................................................................................................

C:\Program Files\Statistical Flexibility\pt-BR\ProtectionManagement.dll.mui

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	66968
Entropy (8bit):	5.458972888809514
Encrypted:	false
SSDEEP:	1536:lOxajnY8kXdtvFHkshj4F1BViSzlLP3zWw:lOokdXRYimdfyw
MD5:	38DE02B3C6D9FCB739BBE589B031F018
SHA1:	34DFB30BA68C40443DD1C32E2C24D882E438A8F6
SHA-256:	077E7988D57A99FDCDD851E0A2A780A60DA28CAC92918B548A1DE1119C9D195D
SHA-512:	62136359B354ECEF0F7ECE6D7E5FE4932D4024C965637B5F565D649B1E6D171C7ED44ECAAE63D8C6B09F570592F63BF6E0D79C5B3CA07BFB7A3339FDFB626C7F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X=..9S..9S..9S......9S...Q..9S.Rich.9S.........PE..L..................!...&..................................................................@.......................................... ...................%..............8............................................................................rdata..............................@..@.rsrc........ ......................@..@..............A.........l...P...P.........A.........$...........................................8....rdata..8........rdata$voltmd...P........rdata$zzzdbg.... .......rsrc$01.....&..0....rsrc$02.... ...`.c...\i.....D^p........."..A.........................................................................................................................................................................................................................................................................

C:\Program Files\Statistical Flexibility\pt-BR\mpuxagent.dll.mui

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35736
Entropy (8bit):	4.971272750821113
Encrypted:	false
SSDEEP:	384:vQF7kUhHQBKYupzqOYA8HnPWS+/WQdDBRJr8EpcR9zCtN:Odhq3Avdd1P4Epw9zO
MD5:	6FD1A39C211DD3188A0969A4B11C1862
SHA1:	582471941A31C5CA75DD4CD92136C6B09F19F0C6
SHA-256:	13991CF8FB8AF1D449884CAD596B9C8C1BD732291C633DE693BFA7C42774D8C8
SHA-512:	F9ED6DDFB4A8FE1BDB24D4C9194374AC075EE4F967D261B05152BB53227DA6B7DC965B4EBBF5ECD205116401496665A0BF984E9990F09D2D8D201DA99C699185
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X=..9S..9S..9S......9S...Q..9S.Rich.9S.........PE..L.....mK...........!...&.....d......................................................`(....@.......................................... ...a...........f...%..............8............................................................................rdata..............................@..@.rsrc....a... ...b..................@..@..............mK........l...P...P.........mK........$...........................................8....rdata..8........rdata$voltmd...P........rdata$zzzdbg.... .......rsrc$01.....%...[...rsrc$02.... ...Z...S.......u2'......q6u3g...mK........................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073394438586539
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrz:KooCEYhgYEL0In
MD5:	4D5BE8DB8EA4ADDFFB24D1B8F1740D6A
SHA1:	26271528A9DD66B8EBD41D1BD81D0DB893D99E7A
SHA-256:	18EBDC075E3834FCA9150D37BC69DD6AACABF3BEE7BAB3A3C73E13DE0E43C17E
SHA-512:	ABAF62FF299D8F7B965CC2F6B8744CDB57610D0BA569A4B512772D64C021D63D0701A5E02449BC63CDD02B0220FE343AACABE35055BBF1DA93934DD465D68A0F
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x59023cbf, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42210913752199153
Encrypted:	false
SSDEEP:	1536:BSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Baza/vMUM2Uvz7DO
MD5:	3534A031326D5AEBBA7D141DFF632DEA
SHA1:	1538D21892CDC893069C37CD967B336BAA867CAB
SHA-256:	3E86420DBC6EA2E071B64ED06E9294892C8CBBA7080BF3F631A19C2BE3C391FB
SHA-512:	BEA6128207CD7C1852EA1862CF8D2A424699A769C46CCEB4E7B735CA47DB809A5CC5DB7869835ED95AF7A94B637F4471FA63564E6E0CE079B0419080180B2890
Malicious:	false
Preview:	Y.<.... .......A.......X\...;...{......................0.!..........{A......\|A.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{................................... \......\|A..................._......\|A..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07539358356651193
Encrypted:	false
SSDEEP:	3:rhmXEYeVzkxjn13a/bD7w/XallcVO/lnlZMxZNQl:kEzVwx53q/xOewk
MD5:	BF43367CD5EADC0D8A1616A0C73F12D7
SHA1:	763E7CEE714D623BE89B61F54942B8AD0ECFDC06
SHA-256:	84272907329E1C20C5B3325BA364E634AAF4D5A698C72241D4A265018F013847
SHA-512:	68AC078209AB59C4F7EE166E1CB921A41345C474AEE5FA12FEF5482B21CB4A4857F0C7C42E327892DBDDD6B498B45EFD69C87C7786AAB69EA2E6E83040B23AB3
Malicious:	false
Preview:	.......................................;...{.......\|A......{A..............{A......{A..........{A].................._......\|A.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Treatments?Secure.exe.log

Download File

Process:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1902
Entropy (8bit):	5.359890904720942
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkCHKe66HKnHKKHKs:iq+wmj0qCYqGSI6oPtzHeqKkCq16qnqY
MD5:	0B43175C046B4AEBE7E843D7A5755B08
SHA1:	42493A4EEC404259F1A9F261D7CB051337EB3F7D
SHA-256:	ED7D7D6E706827D71D6A546D463F6B7C0E46E8FB6C9A39867143C889684F556B
SHA-512:	8D89C45CEF1D880504A032AE5488EB2A8BCD85AD75DCEFA88CE55CCC3C9F1BA3ECCCB235582692D06D9DA9006B36CD356DC7FAC91DEEEB58D4AAEACA2D8F7ACE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Update.exe.log

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2751
Entropy (8bit):	5.372322730968244
Encrypted:	false
SSDEEP:	48:MxHKQwYHKGSI6ouHlJH/lEHuFKHKS+AHKKk7O6HFHKp1qHGIsCtHTHNHkbEHKxHO:iqbYqGSI6ou/fmOYqSJqKk7jlqpwmjCX
MD5:	E186D8CCFA77C108F5C38908EF87820C
SHA1:	47495A5AE5BE859D96CD2C2BD276A4B9A8B441C0
SHA-256:	E2CDF4184CFAFC04DCEB16A3AB1826DBB566B677590B5852A74411BA8B308142
SHA-512:	4173349453148C359F9E0DD698D7C8142A3198BD327722A3D5D5BD1C19F9695EFE732DB3769FB938FF3705AA3CC35A90EDFF2B2ED6F08F2901E376C6A3A1EE5E
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\WindowsBase\95a5c1baa004b986366d34856f0a5a75\WindowsBase.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\PresentationCore\ef4e808cb158d79ab9a2b049f8fab733\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_64\Presentatio5ae0f00f#\

C:\Users\user\AppData\Local\SquirrelTemp\RELEASES

Download File

Process:	C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	86
Entropy (8bit):	5.009422063632745
Encrypted:	false
SSDEEP:	3:sniSOikCHE7FcZjAv8bJxrGNVcUW:sFk6E7Fi8v8bjGHlW
MD5:	EE7B9E362934244E8980E44B050B9E0D
SHA1:	2510E14B4AE417A90957E75C180FC2284D0E8172
SHA-256:	EC99554B263B196A729531DB8FFE6D2C5B950B142451A719CEC887815DB2C7CC
SHA-512:	CA35BEC016E3553863BF503C07EAEDBD56F100A5EF124379A87EDC5FB1F76B386993E6ED278AB05F2D3D1564B35B9F7EA065D42EEEE03297E5037972D4D632C9
Malicious:	false
Preview:	.D831BAC4767C95B8EA898D6DF64F7613F2494309 TreatmentsSecure-1.0.0-full.nupkg 17420913

C:\Users\user\AppData\Local\SquirrelTemp\Squirrel-Install.log

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (382), with CRLF line terminators
Category:	dropped
Size (bytes):	2593
Entropy (8bit):	5.309832987889247
Encrypted:	false
SSDEEP:	48:4J/tHBC5XeT95SGhxL96tmJTcvXbhT/MeTgu2HvT7u2HPDM5Z6dDTpHvTiHPDM55:4JlhAOj7V6toQlN1IWjkDZLkDWi43P
MD5:	E7791152D6CEF0FA345ED666E1272065
SHA1:	C322B467B6C2829E4CCBC109F82F6CE1BCA7F6B9
SHA-256:	252C2051359484BDBCD904296FB7A1EEC1073F038FFA50FA27627DC01C2586EE
SHA-512:	BAFDBB7A9AE5CCD3F20E33B571A9B6A94B4C47046E2D46782D3B71A4D8703A3414D90AAFDFB38C66AD9366F57FAA6FAB624DCA73C7DE4B0094082E0F093D1E99
Malicious:	false
Preview:	.[30/08/24 06:31:02] info: Program: Starting Squirrel Updater: --install . --rerunningWithoutUAC..[30/08/24 06:31:02] info: Program: Starting install, writing to C:\Users\user\AppData\Local\SquirrelTemp..[30/08/24 06:31:03] info: Program: About to install to: C:\Users\user\AppData\Local\TreatmentsSecure..[30/08/24 06:31:03] info: CheckForUpdateImpl: Reading RELEASES file from C:\Users\user\AppData\Local\SquirrelTemp..[30/08/24 06:31:03] info: CheckForUpdateImpl: First run, starting from scratch..[30/08/24 06:31:03] info: ApplyReleasesImpl: Writing files to app directory: C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0..[30/08/24 06:31:04] info: LogHost: Rigging execution stub for Treatments.Secure_ExecutionStub.exe to C:\Users\user\AppData\Local\TreatmentsSecure\Treatments.Secure.exe..[30/08/24 06:31:05] info: ApplyReleasesImpl: Squirrel Enabled Apps: []..[30/08/24 06:31:05] warn: ApplyReleasesImpl: No apps are marked as Squirrel-aware! Going to run them all..[30/08/2

C:\Users\user\AppData\Local\SquirrelTemp\TreatmentsSecure-1.0.0-full.nupkg

Download File

Process:	C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	17420913
Entropy (8bit):	7.999526883695521
Encrypted:	true
SSDEEP:	393216:cx0shmbYDbq5FvRrtoQUq1B5ZpgZ7BE1+QYkm1o42C/Iuj85FI:cx08mT5FpxDUq5ZSZ7BEkrkF4fPj8bI
MD5:	00841FBFEF6CD77345812E0F2DB61F08
SHA1:	D831BAC4767C95B8EA898D6DF64F7613F2494309
SHA-256:	2CF4D07D51B9C48A99D3FABEEBB03A675A921C28EF118D7FBBC849D2DC1862A5
SHA-512:	061521009D3C9A303BE898A9EE1A07F6DA842947BD548FFE73A2ECF5924203EF363B2FE249559E07CE374E35C4F7B5E31460334130E6AD595DA92F28156D9D34
Malicious:	false
Preview:	PK...........Y................lib/PK...........Y................lib/net48/PK...........Y...e....r......lib/net48/aeevts.dll.].\|.S.?..n...MF......D..S[[.m.QkKw.[..J.(..!.!..p..P..V...0.'.0Di~....9..;...v........q~....r.].\|.B&.....G...<.06....h.........gw.U........WT...i.....U.Rs.l.sJg...Y..2....~...I!s.e+..Ir./+q`...4.J.6..~=._..@.m.....T.C..:.toD.....M.tW?.P.....+....VE\U...O\|UuU.bu..~..$......d@u1..6.I.p.S.F...U.......M.....:..p...6E.....e.1.!..G...".....M...rP..F....b.Q..p..................p.?/.......BIu...8V...FM.w.....T..,..W'... v!...7.&...0.\S./.....x.....?.ZS......(..UAz5.....F....-.J..a5.......S!T...T..p...NR....\....8......z..........0%..>p?DQo!).ZQ.H...C..w...GC.n8..F@.1h.....].y.A..T.Q.I..0..#y..e.).F.&....W.=q8W..!=..g...3..\|.7.8P.`........d(..W..j.... ..$B1.}..YF...Q..... ....@.ZhK...?.5...K.2...%G.Ku.h...j.rRV.......Y.O.W!.S.i9..$.....u8.?.&.....g.X..}..r..............)J+..:.N_a../.c...."F\_...D..rV.....p5a....3>3yb..ga.(.....

C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

Download File

Process:	C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1899520
Entropy (8bit):	5.894883178349122
Encrypted:	false
SSDEEP:	24576:pWltPuAnUCiag6CKM2zCy9sQuOjj1VgZej6GeS4lNrCze5qhYp4t9m2:0t3UCiag6CKM2zCyZuOjJaxSS5qh
MD5:	A560BAD9E373EA5223792D60BEDE2B13
SHA1:	82A0DA9B52741D8994F28AD9ED6CBD3E6D3538FA
SHA-256:	76359CD4B0349A83337B941332AD042C90351C2BB0A4628307740324C97984CC
SHA-512:	58A1B4E1580273E1E5021DD2309B1841767D2A4BE76AB4A7D4FF11B53FA9DE068F6DA67BF0DCCFB19B4C91351387C0E6E200A2A864EC3FA737A1CB0970C8242C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5.p_............................>.... ........@.. .......................`............@.....................................W.... .......................@....................................................... ............... ..H............text...D.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................ .......H.......LU..............,.................................................{......{......{....r.(......}......}......}........0..S........u......,G(.....{.....{....o....,/(.....{.....{....o....,.(.....{.....{....o.......0..K....... .A. )UU.Z(.....{....o....X )UU.Z(.....{....o....X )UU.Z(.....{....o....X..0...........r...p......%..{.......%q.........-.&.+.......o.....%..{.......%q.........-.&.+.......o.....%..{.......%q.........-.&.+.......o.....(........{......{....

C:\Users\user\AppData\Local\Temp\.squirrel-lock-7AF78CD06F3A0347B97EC49DA9489AB48CA7E52D

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ISO-8859 text, with CR line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:9:9
MD5:	A7E0F8AC46398A7876D1E40DD52C2AAB
SHA1:	B66922B4E6F09E23C072E4AFF49C67C3121DD5AF
SHA-256:	05174BBF0D407087E45B12BAAE17117426852FF3A9E58D12A0EBB9A10B409743
SHA-512:	E6B93215582F7F4F5E9292273A9466B5D0CC3A4EA7D77AE42854203755441DD5EDBEFB11FE8890CAE7783E41E2EDBF61EC7B03D7E5E9870A7821D4016B095F79
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\TreatmentsSecure\Treatments?Secure.exe

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	195072
Entropy (8bit):	6.452140236964571
Encrypted:	false
SSDEEP:	3072:iZzaqLh5m21b4n86fZHi8c62bdq32BsWtEGwF4JOAg0FuDTT6ERRMU:iZzvhs2Z4n1E7g34XtVYAOfTdIU
MD5:	2873B2581356FB2B4D802425504A6677
SHA1:	79CA26291B64985DE6960D8C1F322E79C8781792
SHA-256:	3336CDF24632E4ADA0E6C1ECA8DBA649BDE5A62E04554A58DFF41729BD67886D
SHA-512:	82555B418155BF47DEA008684EFA88B5D88A32AF9F5D91E9671661A7EE1711341A4FBDAEB23B4AE502DA36E0D916A3CBC73D24015E95D7DFED5EEA25ABDECF31
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........e..O.S.O.S.O.S.).R.O.S.).R.O.S.).R.O.S.'.R.O.S.'.R.O.S.'.R.O.S.).R.O.S.O.S.O.S5&.R.O.S5&.S.O.S.O.S.O.S5&.R.O.SRich.O.S........................PE..L.....p_.....................:......+.............@..........................@............@.....................................<................................!......p...............................@...............,............................text...8........................... ..`.rdata..V...........................@..@.data....#..........................@....rsrc...............................@..@.reloc...!......."..................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\TreatmentsSecure\Update.exe

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1899520
Entropy (8bit):	5.894883178349122
Encrypted:	false
SSDEEP:	24576:pWltPuAnUCiag6CKM2zCy9sQuOjj1VgZej6GeS4lNrCze5qhYp4t9m2:0t3UCiag6CKM2zCyZuOjJaxSS5qh
MD5:	A560BAD9E373EA5223792D60BEDE2B13
SHA1:	82A0DA9B52741D8994F28AD9ED6CBD3E6D3538FA
SHA-256:	76359CD4B0349A83337B941332AD042C90351C2BB0A4628307740324C97984CC
SHA-512:	58A1B4E1580273E1E5021DD2309B1841767D2A4BE76AB4A7D4FF11B53FA9DE068F6DA67BF0DCCFB19B4C91351387C0E6E200A2A864EC3FA737A1CB0970C8242C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\TreatmentsSecure\Update.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5.p_............................>.... ........@.. .......................`............@.....................................W.... .......................@....................................................... ............... ..H............text...D.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................ .......H.......LU..............,.................................................{......{......{....r.(......}......}......}........0..S........u......,G(.....{.....{....o....,/(.....{.....{....o....,.(.....{.....{....o.......0..K....... .A. )UU.Z(.....{....o....X )UU.Z(.....{....o....X )UU.Z(.....{....o....X..0...........r...p......%..{.......%q.........-.&.+.......o.....%..{.......%q.........-.&.+.......o.....%..{.......%q.........-.&.+.......o.....(........{......{....

C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\AMMonitoringProvider.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	214352
Entropy (8bit):	6.043733758501481
Encrypted:	false
SSDEEP:	3072:wC3HjG5Tg1HlnGEx6s8Pt0TOAsdPgrjnKRKisSNm50i+B5KTedUQqm1FpCShisD:wC3OTg1AExYWCA4PeTKRKiRc5MT1vh
MD5:	573FA5E140E6B7C6209B546511DD0989
SHA1:	28BEFE7EF26AE909FEB74AC4A8C9981BED192A93
SHA-256:	BA543F2CF16CB1D1CFA87D7531E6045581EE76274C36D0C9DF8C131E05B86977
SHA-512:	6E43E60743207E0C50B42BAAAF0DE71F544B579292F7907360BE0926C56C74D06CAA4E7BC0ABF5AA857400D8A573BF820905F0B9283C26EE5CD2E0E3320736BF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... )L.dH".dH".dH"./0!.`H"./0&.pH".dH#..I"./0#.EH"./0'.nH"./0".eH"./0*.=H"./0..eH"./0 .eH".RichdH".........PE..d...u.W.........." ......... ...............................................0......9.....`A...................................................@...............x.... ..P%... ..4....Y..p....................'..(....%..@...........8'...............................text...y........................... ..`.rdata..............................@..@.data...............................@....pdata..x........ ..................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\ImagingEngine.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2380288
Entropy (8bit):	6.392269103354355
Encrypted:	false
SSDEEP:	24576:RJmwxsgMIqy/Oy5V4oexJAydXbrLq9VNuE7iKQOf0JNeCWNqAgoYpOGyb4M/N2Ys:7mWJ1q2DcxJ3ZAVk/jJNz2YpRO4MS2U
MD5:	C799531DB6B9C7AECC71B89AFCB6EB7E
SHA1:	BFBB86F5CF2BDC7DDA0DB4AFCE39A4B89045CF3A
SHA-256:	028F0C77E3705E3AD5387A5EEB5902997E40D983324C2AE44AAFB8AE53A67F6F
SHA-512:	7EEF7B9A6A83BE4C2B3414EBC26295C408697E5214B38634E7F983752AC2B85075C7C66C0469E8C45E2F2B49F16D5DAA41D5449BDB2134BDF098438927B0425F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zcm.>..X>..X>..X...X=..X...X...X>..Xv..X...X)..X...X-..X...X?..X...X...X..}X?..X...X?..X...X?..XRich>..X................PE..d...WKPT.........." ......".........@f........................................$.......%...`A..........................................".p...(H$......p$......0#.H.............$..J...2..............................`................@$. ............................text...."......."................. ..`.data...@_....".."....".............@....pdata..H....0#.......".............@..@.idata...!...@$.."....#.............@..@.rsrc........p$.......$.............@..@.reloc...J....$..L....$.............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\MpDetoursCopyAccelerator.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	103672
Entropy (8bit):	5.463582216147117
Encrypted:	false
SSDEEP:	1536:9QyB1n0kg+iFMx3/TOw987XxhLTdCfDQl/0agrW7mPfp5PRnNazo:pn0k8FM5/TOw27XTdCfDW8nNPfp5pNa8
MD5:	5B57B2C8291FE382F8F87E91A19B5BB9
SHA1:	0B4224F7DA53BF49A1A822DA111464B185657A8A
SHA-256:	48732B6B8C62DAEA68F2C38EEDEEA59DA2F142403AF9EE0D8D77181BDD22BBD1
SHA-512:	4E2012B7C19319A97F4AAA7C94DD7427C850B30EAD8E679F8140AF60724AEACDFA943BA9501D456F66DB08E2325772B90F2F8E5502AB63909F5F4BED97FEC8BF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.f.>...>...>.....?......4......2......9...7...1...>...0............?...........?.....?...Rich>...........PE..d...R.L..........." .................^....................................................`A........................................0...H...x........`..`....P.......p...$...p..........p...................h...(...0...8...............0............................text............................... ..`.rdata..*W.......`..................@..@.data........0.......0..............@....pdata.......P.......@..............@..@.rsrc...`....`.......P..............@..@.reloc.......p.......`..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\MpOAV.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	496912
Entropy (8bit):	6.014056505362478
Encrypted:	false
SSDEEP:	6144:UTmg/KSnLsE0aGPrR4IcdwSbttHRqJULrf6KmiTVVmVVV8VVNVVVcVVVxVVVPVVQ:UxSrR4Ic7bttxqJULrTj
MD5:	82D45EE8BCA40389EA79879C75EC6207
SHA1:	86108949630649367EA91153EEE86F2FDC9F2489
SHA-256:	CE0B09D43134DD41BA555AAF18DD491EC610DD503864CAF7BFFF60AFB73F8ED5
SHA-512:	8E03CC2B53635BBA4D3AB21946C20D91B8387BE0FDEF700A893104AD5153CAF2632A1D51766DEBCA6A05C35F15B40F08A20EE52FD154938D930406C0A8F354EE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......EA.G. ... ... ...U... ...R... ... ..-!...R... ...R... ...R... ...U... ...U..M ...U/.. ...U... ..Rich. ..................PE..d..............." ..........................._....................................\|.....`A................................................D...x............`...#...p...%......t.......p....................8..(...P7..8............8..p............................text...2........................... ..`.rdata..............................@..@.data....0... ... ... ..............@....pdata...#...`...0...@..............@..@.rsrc................p..............@..@.reloc..t............`..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\PhotoAcq.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2009600
Entropy (8bit):	6.695405096347361
Encrypted:	false
SSDEEP:	24576:rpnHEmh9wLtf1q1GfFQiLjnHTIDy191GcQPdGktxvxr5oCAd6VoYXDLilE3vSW:rJnELGGdlTRscQPJtxvxbmYTL9j
MD5:	5D6C68F3366BE4A8A72530C96FB2BD39
SHA1:	64E72E3FF6CD326F301B9769C5E59FB6346FE197
SHA-256:	079A9DA4FB99A672EF96D17475A7EBC86F96AEF9C2BBF79DD466CD69A1410F43
SHA-512:	D67F17F2B45250E3356BB59CEFB9425F203D642329B68875405583F34F4996D6535BB633FB4C3284819B38DED8AF37C9FC6CB6D188503572F97F5DF8159B1924
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e.!...r...r...rr..r...rr..r...r...r...rr..r...rr..r...rr..r...rr..r...rr..r...rr..r...rRich...r........PE..d....IPT.........." .................>....................................................`A........................................P.......0........P..(\|...P..H................)...!..................................................(............................text...2........................... ..`.orpc...I........................... ..`.data....(... ......................@....pdata..H....P......................@..@.idata...j.......l..................@..@.rsrc...(\|...P...~..................@..@.reloc...).......*..................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\PhotoBase.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	45568
Entropy (8bit):	5.758853451336097
Encrypted:	false
SSDEEP:	768:DJkWhhIF/cYUvsDrZISzKyDDNSVO1kcLQV3OeorXIk+baBiq2:DJn6lcYUvuFSozfcfn
MD5:	E93245606766FBA0CF76A495921E87F1
SHA1:	A2BEC6ABF7590FD309259AE7FE0F640ABE0E3809
SHA-256:	00E0F392E9CF2303B50B6C1AB74BC08AF29F9F7144C23647C3A32D29CA5311CB
SHA-512:	9CC9E7441C9B44549A594B2D9A0E820A76DD9E56568989EA7AD28DD00B7090BB68D22451C34BF77EE8C193C555FC3EF3626283FF2CCAA4447140EAC4DC040407
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m.Z..............-......./.......,...............).......(.......1.......+.............Rich............................PE..d....RPT.........." .........$.......n...............................................#....`A....................................................P...............................d...................................p................................................text............................... ..`.data...............................@....pdata..............................@..@.idata..............................@..@.rsrc...............................@..@.reloc..d...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\PhotoViewer.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1844224
Entropy (8bit):	7.146209904439262
Encrypted:	false
SSDEEP:	24576:3q9hsgYEKvAj6cZhkbxJyNDNyvM0W7439KQ9l2oWIoWIoW:eYEKvAjBgbvyJNaW743YQ99WRWRW
MD5:	6DCB6E47167F66C3D797B93BB1CCA386
SHA1:	8D94380FA31EFB93765B4EE64A65E9E52A2AD92F
SHA-256:	BBA4938A8F952BCA5BF6668F425C511E077A10D3389683A70929236906D0E79B
SHA-512:	BCF75FB53D070ECA3CBADC12D40D550A1F6AEEDA769221CBE64C4900B74EBA79A0E626BDA739AEBB35D64985E54E083162A5580D34E83CE91A0493C92B86FA83
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,3R.hR<.hR<.hR<.a*..jR<...kR<....R<.hR=..P<...MR<...`R<...iR<....R<...iR<...iR<.RichhR<.................PE..d....IPT.........." ................P...............................................B.....`A........................................p.......hb..........`.......,g...........`......."...............................#...............P..`.......@....................text............................... ..`.data....-..........................@....pdata..,g.......h..................@..@.idata...O...P...P..................@..@.didat...............l..............@....rsrc...`............n..............@..@.reloc.......`......................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Readme.txt

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	100
Entropy (8bit):	4.483794256644283
Encrypted:	false
SSDEEP:	3:8VyiHoHaRf2cWJPGEA+uR0IEREaKC5Suf2cWJPGEh:8QiIH+DPiuR05iaZ5SuDPE
MD5:	40449167E31198AD84BC4671A6D88F6E
SHA1:	80B1A770D3E635C8F52D2A66E3A65A44A997BD03
SHA-256:	514B841BF01A606E00B82685EF68FD105B5FC2A2C1AEAC1269E4626A87EAA8DA
SHA-512:	778FA2C30593BB6F3A6A3F46BAD5918B4EA15805FF0D254E872EA5A636C069B1DCB33CEB5298120057CB37868E42987EA5C8D67D326F579B6E9FCBEFD556A2DB
Malicious:	false
Preview:	appdata\|\Microsoft\SystemCertificates\|C:\Users\NOMEAQUI\AppData\Roaming\Microsoft\SystemCertificates

C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\SmartCardSimulator.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	710144
Entropy (8bit):	6.1294528117158
Encrypted:	false
SSDEEP:	12288:VcHJD66b2mwYc94ka2S8U8Si0i4bNucPErWIgIH8ch:VcpamZcEucWTHx
MD5:	42237DA26CC425F74C77DEFBBEAFCE6A
SHA1:	EF2AD785001CDBA48F04E5C28035323FA9ED36A1
SHA-256:	62320F2771F7AA841A9E5A60F0C543974C41873208A909E9D0B357BD0723822B
SHA-512:	D5572437C6C76A3C00A4F533206F32243396A8E5EBD2127AC377002B1D9D0DC9277A1D76C28CB1546AE864D9031A7C3B8A3A652AE8524D7472680E5F84A97B8B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................Olx...Ol{..... ...Ol~...Olz...Ol....Olf...Ol\|...Oly...Rich............................PE..d...pPPT.........." ................@........................................ .......h....`A........................................ ...................P.......t^..............D....................................................................................text............................... ..`.orpc...9........................... ..`.data...8u.......j..................@....pdata..t^.......`...P..............@..@.idata..............................@..@.rsrc...P...........................@..@.reloc..D...........................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\SmartcardCredentialProvider.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1396736
Entropy (8bit):	5.928124152275983
Encrypted:	false
SSDEEP:	24576:4+Cj00Ni/TL+NVPgE/5wmE+Q8tHZez7D:4uSN5gE/5FE+Qr
MD5:	93C4E932E75D01179A5E9048AA47E47E
SHA1:	6D63D5616B5409972A79AA5D70A0CF09888EC8D1
SHA-256:	ECF614D124861504E00F4D8C4A09A53C1D94ABCBD48EAABC34756FD4717101A3
SHA-512:	0C6A68392C0EC87F55F2CF7861A0293B777B2C0EB1E20ACDB4A33133405AAE0561EDB0F3444B777CE97CBD2C7536C2FA15A2F262387190EDB9AB7F2F3D287B6A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Uu..............6.......l..%.....^.........H.....X.......\.......].5.....Y.......K.).....Z......._.....Rich....................PE..d....=PT.........." .........B.......................................................3....`A........................................x...~......D.......(.......................d...P...8............................................................................text...d........................... ..`.data...._... ...\..................@....pdata...............n..............@..@.idata...%.......&...`..............@..@.didat..............................@....rsrc...(...........................@..@.reloc..d............>..............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5219328
Entropy (8bit):	6.303946263269839
Encrypted:	false
SSDEEP:	49152:vKOs+WPTtK3J8JVCCTxvXd4XW2aJXLLJTsEjsvkNP0h96WR/XArdauCibwtaGbX8:HkwOCUVXdXThgeg/OE5t9bX8
MD5:	EF8AB76732B42F96F650419850193A0F
SHA1:	AF33E61E72A171ABEA33619C997C48C9DD284B2C
SHA-256:	FA1261B8DB59590885944AE78C719E405311D3B50B0770B6AA443736D6B7CDFA
SHA-512:	46598478C2DDEB0E8E9C68293CA388F58CF95BDC4ECA7D7B77FEA024F92059624CF723839F1F1A8985E72C0497DF3924B63EB0696A15927C6BD682312DA1D172
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 13%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f..................O...........O.. ....@...... ........................P...........`...@......@............... ........................O.W.....O.......................O...................................................... ............... ..H............text...".O.. ....O................. ..`.rsrc.........O.......O.............@..@.reloc........O.......O.............@..B..O.....H........KO..m......x.........N..........................................0..s....... .... o..Q.Y.s!............s".......Y....o#..........-.s$............o#..... .%i..X.Xffefeefeffe .bT>.Y.Yfefefeffea...-..+...o%.......,.. .?g..X.afefefeffea...-..+...o&...........('...((...,.. ...Q.Y.Y.Xa..~....`.....8.......((...,V....(....,&.. r..X.affefeeffe.Ya.~......`.....+K.~....`...... ....a.Yffefeeffeefa.+&. w...X.afefeffeefef.Ya.~......`......~....X.....*..0..........~.......o)..

C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\VaultRoaming.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	92672
Entropy (8bit):	6.019183226845426
Encrypted:	false
SSDEEP:	1536:TA1iMbbBhwtagMqDNmRrYC9re+LOtOqqUtGYRHRkFHY8:IiMbbBhyagMWmx9S+W0UtGnRX
MD5:	F40239E208D5F3253794F5996739F01E
SHA1:	0AF698547ACE4D2F02384A2FA57CB70AC90A8FCA
SHA-256:	A1253B4F874B2CE60EA11A660B7D34DE397EFF350B701524B76BD44F0F644A16
SHA-512:	09774341FC3AD1BB0DF40B20886188EB04ED884221B6F9FF2E50C042B77A45358C70B1A40C8B25890DA4D77D4AB1FF02E1E47A3F42DBC224E03D5D95BFF59CA6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........5T?ST:lST:lST:lZ,.liT:l...lQT:l...l\T:lST;l.T:l...lXT:l...lUT:l...lRT:l...lYT:l...lRT:l...lRT:lRichST:l................PE..d....@PT.........." .....&...H.......;....................................................`A.........................................4.......d..D............P..................<...P...8............................................`...............................text...^%.......&.................. ..`.data........@.......*..............@....pdata.......P.......,..............@..@.idata..@....`.......:..............@..@.rsrc................R..............@..@.reloc..<............f..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\aeevts.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29184
Entropy (8bit):	3.7627429919043482
Encrypted:	false
SSDEEP:	384:RBWyhTWZgQAI2mNCOsF/NvjwWJG9Ng1sinSgnJs1a2aNa2aJqMcq0Se0iiC:RVQPUSfZe0iiC
MD5:	B33F85A7BA316694E46D6965BFCB1109
SHA1:	B16CD83211E0BF50B7D75699268AA76C41A4CEF1
SHA-256:	89EF3A610F73C71DC49EC52A4CCA1B778A5B399BD38732FD27AC268C28B6682C
SHA-512:	F2013906A55BF33BB49B5498ADD05F7302DFAD0A93271D68FB966B6BFEA8FAAC7A8077D7D47D00BE87EA43B2B1F76AA19319A5BF9C2706E1F6FEB092FC78DC4D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........R..3}..3}..3}.H...3}.H...3}.Rich.3}.................PE..d......R.........." .........p.......................................................!....`..............................................................n...........................................................................................................rsrc....n.......p..................@..@............................................(.......@.......X.......................p............................................................................................................................}...................i............................W.E.V.T._.T.E.M.P.L.A.T.E...M.U.I.......4...V.S._.V.E.R.S.I.O.N._.I.N.F.O..................@.%.....@.%?.................................S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.4.0.9.0.4.B.0...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.

C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\aeinv.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	537088
Entropy (8bit):	6.355810367161
Encrypted:	false
SSDEEP:	12288:VeY4VSMgRLa+wPRSgtwyr6UoCThdx/wgol7:VejSMgRLQSgtwnUoMVol7
MD5:	18640BDECFFE12E3B2522B081F77FC30
SHA1:	EF6E32620FEDB6319FC84E3D6BD4509FDF1A42B0
SHA-256:	CFD484323081CE4F683D4D2F41D24A39E4E809CDFCD7D3C6A0251772661E378C
SHA-512:	65B1678DFE83DA66360CE0A6C369246F67193E1F23E1A7298072EB133D574917D04247A5A04467194A61E3BDDF466BBBE2D32063180F97B22E66DBC7EEE18EA8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e..j!.9!.9!.9./N90.9./M9#.9!.9..9./K9..9./O9-.9./J9 .9./X9m.9./I9 .9./L9 .9Rich!.9................PE..d...8NPT.........." ................................................................((....`A.................................................8..T....`..(.......D4...........p..0.......8...........................P>...............0...............................text............................... ..`.data...............................@....pdata..D4.......6..................@..@.idata..&%...0...&..................@..@.rsrc...(....`.......&..............@..@.reloc..0....p.......,..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\aelupsvc.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	214528
Entropy (8bit):	6.2807683811373405
Encrypted:	false
SSDEEP:	3072:QORLNs3BSQQ0EKoioHK1swFj9M2eqpl1hciEAIAx+E1frlNitBXJ1Yn:fLrxKgK1sKMkpl1hcAOElrlNc
MD5:	BCD58DACAA1EAAADC115EDD940478F6D
SHA1:	828CF07E98ACB780ED98EE12872BB4738A4BD90C
SHA-256:	F31613F583C302F62A00E6766B031531C9E193CAED563689B178BA257715B992
SHA-512:	5A78AE4AC8772A04B3FDB7C8D778C873E22795B6A15435DF424E1FCEE107CC4CF1943DB3D55784812BE09381F3E61033A57690DEB6B695A67344D73B70CA5EA6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z.............%..............%......%......%......%......%......%......Rich............................PE..d....TPT.........." .........p.......B....................................................`A.........................................a..o...pF..@....p..........."......................8...........................PY...............@..h.......@....................text............................... ..`.data...h...........................@....pdata...".......$..................@..@.idata..2....@... ..................@..@.didat.......`.......4..............@....rsrc........p.......6..............@..@.reloc...............B..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\aepdu.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	688128
Entropy (8bit):	6.36490643526536
Encrypted:	false
SSDEEP:	12288:2VoBr72421Ie1P0zS/j7/mkWFJQBQ/ZNXBQQ:2Votoazv7XBQQ
MD5:	2953772F25ECCF74B04306E94C686CED
SHA1:	419EC3834F126CBC964228A50AE09A63C1A8DD94
SHA-256:	70FD6B9E4FACFB2583AF60F5778E6527DDEE7067FDC2BAF47C939BE0F538D18F
SHA-512:	2DE271853B82B1526621B52543AF061B64E33D0B9B8EEDBBB6831FA36981CC361F82D92FE0EC89D432D54C03978958A695DD07F30E8C1D11D6659730F271D08F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8.;.Y.h.Y.h.Y.h.!dh.Y.h[.9h.Y.h[.:h.Y.h.Y.h.[.h[.<h.Y.h[.8h.Y.h[.=h.Y.h[.$h#Y.h[.>h.Y.h[.;h.Y.hRich.Y.h........................PE..d...Y6PT.........." ......................................................................`A............................................L....\|...............0...7..............\|...@...............................0................p...............................text............................... ..`.data...X...........................@....pdata...7...0...8..................@..@.idata..L;...p...<...8..............@..@.rsrc................t..............@..@.reloc..\|............z..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\part1.cab

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	10100704
Entropy (8bit):	7.999981703311507
Encrypted:	true
SSDEEP:	196608:ic5/xKCbd82qFvRrdkTSqpQwfuqqOCZz5Nshqp0AYZVtBU:VDbq5FvRrtoQUq1B5ZpgZ7BU
MD5:	771C3299D3691A50F11A487987120700
SHA1:	2FA5B9D0D6C4498E58D5B93450F998F938735CEB
SHA-256:	8827BAF7B1633C5BA32E385BCC77A801AD6093B365F48D84ABC6863554153737
SHA-512:	A397769825B42FDB75BFAFA0C67045EA1554AE845FDE4C7E1651DF2492AC0CF3B425A9BF6C41A89654AC9B55CA936E0B751F624E1ADED1ADF7E92B930D4579D4
Malicious:	false
Preview:	........i@Q.R..r%f.k]G..i.v..a!r...&.O......e..\..C....(.S...a.F.xt..i..EX0....^..= E....r..^$.lec.gS'2.Zo.....`e`L...1..8.tp%G....N.D..X.a.2.4..E.},....."......\..i.6....#R.5..h&...atp.&N....:.I..z?.YN.E..TH.........p.~.vn.J.+..,..n.0...rLX..1..7.=...m7\|.x...KX..P....I.^..6......,J.V..3,.V3. ...d..>.i.J[..~.).\....;.\|........4y..Gn...)tt.4d.....h..v..]....l\.W.Ozl7....b...L/T....ba.O.{.j?...\XH.-.r......y...G.IP.Y\|;....C....c...s..'.v.....j/`$... ....4.@u....sxJ...b.v.F-.I...rA..jv$.:i.....-....<............BV.{d...&.Um.K............~pzV..}.S....LV@J.zM.K..rg..=q......{.8..e...."..S.G...k+..0.H,2..&..jy....p.Q...q......G.3.1e7...(....d~\.1.]....#.....b..../7....T....!...W......}]......:.?..H.[.q,#1.....^.>=^....K..........w...:...q..71.e.......`.....A..%...Ad..!f\....xC.t...$.VIP.N.s....:\|l.;x.....m.]7...n#.".C#..^^.A..y..eU.._.?...f..6...w...-..A.hL.Q.k.i..2D...+,.....j..OO.Y53_.M.@8.").....'.>..v.W .j..5.j..9...A6..9NQk.

C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\shellext.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	468312
Entropy (8bit):	5.621872137435956
Encrypted:	false
SSDEEP:	6144:+/fJNDoSCaKgg6OEBCOJzXv5ApNMY0lESLMp+W8j1sl3FIY/VLIVuV3Y0CC7HHmc:+/fDTCzgg6T3ALULE+WNl3yCIBL+
MD5:	85E67579A416A86D726D4AEC49F0EF87
SHA1:	2D7D1C1213B09924F926D9C6197A60CC3F617B3C
SHA-256:	112891EB9C3B06F6B95919E34BDDC607AF76EB9AEAEDE8E3BF3147709F0AE3B4
SHA-512:	0FB7A0C0A510A4EC9540B5A6EBA94D27BEEB4B9AE7E17DEF1DD3EF095ACAE5E66ED067EFE4A9873EB73969F48EBF29A0B7B042CEFA9C1E2187B41C00F3ED933F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-G..i&..i&..i&..`^<.o&.."^..m&.."^..{&..i&...'.."^..L&.."^..c&.."^..h&.."^...&.."^P.h&.."^..h&..Richi&..........PE..d....l\..........." .........0...... ...............................................p,....`A................................................x............c...`...-......X%...........R..p.......................(...@...@............................................text............................... ..`.rdata..Z).......0..................@..@.data....H.......@..................@....pdata...-...`...0...P..............@..@.rsrc....c.......p..................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\slpts.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.092666287775504
Encrypted:	false
SSDEEP:	384:x9SsnrbCL7R74Ejd7vYa3BnNFYSPOyW/xW:x9Ssr2B74cuSPm
MD5:	4762AD9664B769EEFF83D67CEAF0FF7A
SHA1:	3BE3062FC0C9485C9011EFB3687EACE0B796638A
SHA-256:	8DE0717711D179CF68951EE3BDFA6BF787915840133DA16B5BFEC972C035A4D9
SHA-512:	97D6381EA489C043AE37DEFC6E94A06CDD13B6838EB43FAC2521B9B99172BB1B0D20EA96D12A6D356F2BB7EBB46EFE25FD07E9C40207364DCB02BD52E488DF3A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........}D.}D.}D....}D.f...}D.f...}D.}E.}D.f...}D.f...}D.f...}D.f...}D.f...}D.Rich.}D.........PE..d...g<PT.........." .....$...$......p&..............................................g)....`A.........................................2...... b..h....p.......P..................0...`................................................`...............................text...A#.......$.................. ..`.data...4....@.......(..............@....pdata.......P.....................@..@.idata.."....`.......,..............@..@.rsrc........p.......8..............@..@.reloc..0............>..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\slwga.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	6.480594167655513
Encrypted:	false
SSDEEP:	1536:0Lz+NUpmFZbwCZtJcnosGEg+jInApM8pTpBo41pUACg:0Lz+NUpmFZbwCXJSGEg+jInApME1Bo8H
MD5:	116EABEA69D40607116D3717D12248EC
SHA1:	1DA03A97030398BCF2F0A66A94267B326617C5F3
SHA-256:	1A98E6D12251CA8F21B8593EEE8F837FF421091BCC1D1299FD8377B62FF961AF
SHA-512:	B018140DC105E0EC103792E75698FE28E48F9A724C26F6EB0546802F3322890EE532DC6115691744208FA9EE4084AF11C79B82187E1C3E09CDB3BB4992DC6BEB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K.-3..C`..C`..C`.t.`..C`.t.`..C`..B`:.C`.t.`..C`.t.`..C`.t.`..C`.t.`..C`.t.`..C`Rich..C`................PE..d......R.........." .........................................................`......C.....`.............................................Q....1..x....@....... ..(............P......@...............................08...............0...............................text...Q........................... ..`.data...............................@....pdata..(.... ......................@..@.idata.......0......................@..@.rsrc........@......................@..@.reloc..D....P......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	98736
Entropy (8bit):	6.474996871326343
Encrypted:	false
SSDEEP:	1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
MD5:	F12681A472B9DD04A812E16096514974
SHA1:	6FD102EB3E0B0E6EEF08118D71F28702D1A9067C
SHA-256:	D66C3B47091CEB3F8D3CC165A43D285AE919211A0C0FCB74491EE574D8D464F8
SHA-512:	7D3ACCBF84DE73FB0C5C0DE812A9ED600D39CD7ED0F99527CA86A57CE63F48765A370E913E3A46FFC2CCD48EE07D823DAFDD157710EEF9E7CC1EB7505DC323A2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.&k..H8..H8..H8.I9..H8...8..H8..I8(.H8e.K9..H8e.L9..H8e.M9..H8e.H9..H8e..8..H8e.J9..H8Rich..H8................PE..d....9............" ... .....`......`.....................................................`A........................................0C..4...dK...............p..p....Z...'...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......B..............@....pdata..p....p.......F..............@..@_RDATA..\............R..............@..@.rsrc................T..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\vcruntime140_1.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38304
Entropy (8bit):	6.3923853431578035
Encrypted:	false
SSDEEP:	768:Xhh4pTUUtmUwqiu8oSRjez6SD7GkxZYj/9zLUr:xJ9x70GkxuZz2
MD5:	75E78E4BF561031D39F86143753400FF
SHA1:	324C2A99E39F8992459495182677E91656A05206
SHA-256:	1758085A61527B427C4380F0C976D29A8BEE889F2AC480C356A3F166433BF70E
SHA-512:	CE4DAF46BCE44A89D21308C63E2DE8B757A23BE2630360209C4A25EB13F1F66A04FBB0A124761A33BBF34496F2F2A02B8DF159B4B62F1B6241E1DBFB0E5D9756
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L......................h.........G.........:...h.......h.......h.......h.......h.+.....h.......Rich............................PE..d................." ... .:...6.......A..............................................B.....`A.........................................m.......m..x....................n...'......D....c..p...........................`b..@............P..`............................text....9.......:.................. ..`.rdata..."...P...$...>..............@..@.data................b..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..D............l..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\vcruntime140_1d.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	54192
Entropy (8bit):	5.982046635193265
Encrypted:	false
SSDEEP:	768:hLq1pDi843Csb7PjWGPB8SkHMyGEvAicWF//dj9z:x2IvWy8pszEIdWZz
MD5:	9EF28981ADCBF4360DE5F11B8F4ECFF9
SHA1:	219AAA1A617B1DFA36F3928BD1020E410666134F
SHA-256:	8CAACA1BFC909FCB972CEADE7BE7B80B5855A4621562EE32A10C9903B616D49A
SHA-512:	EF7F0B25FAE749E6134269683F973FEF37DFA1969FA4FA0567378ADA073C36DA4FEB17B62D3282C443F4D3BA8B4AEB39063C607C848ADE095880D981141ADB9C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PcS...=U..=U..=Utx<T..=U.p<T..=U..<U..=Utx>T..=Utx9T..=Utx8T..=Utx=T..=Utx.U..=Utx?T..=URich..=U........................PE..d....S..........." ... .l...B...... n..............................................7.....`A........................................@..........P........................'......D...................................p...@...............x............................text....j.......l.................. ..`.rdata...(.......*...p..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..D...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\vcruntime140d.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	166792
Entropy (8bit):	5.918604698246996
Encrypted:	false
SSDEEP:	3072:/bKiaqu/TMfyJVm7r0QVTIlxWJxecbNjWKw3t:/0Tmy7m7rXF6xWDecbNSXt
MD5:	A366D6623C14C377C682D6B5451575E6
SHA1:	A8894FCFB3AA06AD073B1F581B2E749B54827971
SHA-256:	7ED89C668D8EC04C1A0A73F35702B8E0D9819E13E6E7C51C4AC0E0ABDA6683E6
SHA-512:	CC7DA40652209337D2122CAFC903D3C11E31B5A37BAF2247034E2F3E1DE255E58D0E27FC134CE60A6812E6674FD8BC899F2B434DFC1160053F684CF220E6CB11
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......aJ..%+..%+..%+...Y.. +..%+...+..EQ..(+..EQ..5+..EQ..:+..EQ..$+..EQN.$+..EQ..$+..Rich%+..................PE..d...P............." ... .....z......@....................................................`A.........................................A..4....I..<............`..p....d...'..........."...............................!..@............................................text............................... ..`.rdata..vO.......P..................@..@.data...0....P.......@..............@....pdata..p....`.......D..............@..@_RDATA..\............\..............@..@.rsrc................^..............@..@.reloc...............b..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\verifier.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	371304
Entropy (8bit):	5.488131066385886
Encrypted:	false
SSDEEP:	6144:pIZX2HrA2V/dJ2De3uT8B3PPCeDgIaUzOVd:tA2V/dJfeT8BHhzpOD
MD5:	8796CC58211FD39FEC633EA802091F93
SHA1:	B3FB1DD0D0DD3DA3A9E814E63C2F04444C0A2D51
SHA-256:	DE4D82DB74164BE9A995B99FADD0804F4E5E0871542C296A670B816C73447DF3
SHA-512:	517376822873D37A5D91159F329C7E2990CD908A044EAA19BDE665D70966FDA341CB3B7231668C73356EE09B2786EE858D9200F7CB34504FE8A24F61B3459355
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Iu..(..(..(..x...(..(...(..x...(..x...(..x...(..x...(..x...(..x...(..Rich.(..........................PE..d....UPT.........." ......................................................................`A............................................B...X...(............`..x....\|..h...........................................@Z..................P............................text............................... ..`.data...d........t..................@....pdata..x....`.......4..............@..@.idata...............P..............@..@.rsrc................f..............@..@.reloc...............v..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\version.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29960
Entropy (8bit):	6.191548561592306
Encrypted:	false
SSDEEP:	768:D5AmckVPxIiTbpY6A6N1NuZJaKZXdE1PvAJfqsk:dAmckVPxIiTb+6A6NqZJaKZXdUPvAhI
MD5:	B85C7E5C747D8C73D0BC0CC79C76FC65
SHA1:	8112F4C7550A8F03EC766A8464066FD7436B1524
SHA-256:	892F1F48F6912FB3A2802DE052121A0F7780582F71DC6E2778094941405A3C02
SHA-512:	E8F313E480FFB3450C3D10F4FD0C9F740AE6B82C2FA6A82E55BD90082243F4A08AC3ADF53D38BED7DBE019DF981AE4C39513BE0242F4109F3E2FD12D37687D3A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0...tx._tx._tx._..Q_ux._..R_.x._..W_{x._tx._;x._..V_ux._..D_\|x._..U_ux._..P_ux._Richtx._................PE..d....TPT.........." .....2... .......................................................\|....`A............................................_....r..........(....`.......R...#...... ...\=..8............................................p...............................text....1.......2.................. ..`.data........P.......6..............@....pdata.......`.......8..............@..@.idata..P....p.......>..............@..@.rsrc...(............J..............@..@.reloc.. ............P..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\TreatmentsSecure\packages\RELEASES

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	86
Entropy (8bit):	5.009422063632745
Encrypted:	false
SSDEEP:	3:sniSOikCHE7FcZjAv8bJxrGNVcUW:sFk6E7Fi8v8bjGHlW
MD5:	EE7B9E362934244E8980E44B050B9E0D
SHA1:	2510E14B4AE417A90957E75C180FC2284D0E8172
SHA-256:	EC99554B263B196A729531DB8FFE6D2C5B950B142451A719CEC887815DB2C7CC
SHA-512:	CA35BEC016E3553863BF503C07EAEDBD56F100A5EF124379A87EDC5FB1F76B386993E6ED278AB05F2D3D1564B35B9F7EA065D42EEEE03297E5037972D4D632C9
Malicious:	false
Preview:	.D831BAC4767C95B8EA898D6DF64F7613F2494309 TreatmentsSecure-1.0.0-full.nupkg 17420913

C:\Users\user\AppData\Local\TreatmentsSecure\packages\SquirrelTemp\tempa

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	86
Entropy (8bit):	5.009422063632745
Encrypted:	false
SSDEEP:	3:sniSOikCHE7FcZjAv8bJxrGNVcUW:sFk6E7Fi8v8bjGHlW
MD5:	EE7B9E362934244E8980E44B050B9E0D
SHA1:	2510E14B4AE417A90957E75C180FC2284D0E8172
SHA-256:	EC99554B263B196A729531DB8FFE6D2C5B950B142451A719CEC887815DB2C7CC
SHA-512:	CA35BEC016E3553863BF503C07EAEDBD56F100A5EF124379A87EDC5FB1F76B386993E6ED278AB05F2D3D1564B35B9F7EA065D42EEEE03297E5037972D4D632C9
Malicious:	false
Preview:	.D831BAC4767C95B8EA898D6DF64F7613F2494309 TreatmentsSecure-1.0.0-full.nupkg 17420913

C:\Users\user\AppData\Local\TreatmentsSecure\packages\TreatmentsSecure-1.0.0-full.nupkg

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	17420913
Entropy (8bit):	7.999526883695521
Encrypted:	true
SSDEEP:	393216:cx0shmbYDbq5FvRrtoQUq1B5ZpgZ7BE1+QYkm1o42C/Iuj85FI:cx08mT5FpxDUq5ZSZ7BEkrkF4fPj8bI
MD5:	00841FBFEF6CD77345812E0F2DB61F08
SHA1:	D831BAC4767C95B8EA898D6DF64F7613F2494309
SHA-256:	2CF4D07D51B9C48A99D3FABEEBB03A675A921C28EF118D7FBBC849D2DC1862A5
SHA-512:	061521009D3C9A303BE898A9EE1A07F6DA842947BD548FFE73A2ECF5924203EF363B2FE249559E07CE374E35C4F7B5E31460334130E6AD595DA92F28156D9D34
Malicious:	false
Preview:	PK...........Y................lib/PK...........Y................lib/net48/PK...........Y...e....r......lib/net48/aeevts.dll.].\|.S.?..n...MF......D..S[[.m.QkKw.[..J.(..!.!..p..P..V...0.'.0Di~....9..;...v........q~....r.].\|.B&.....G...<.06....h.........gw.U........WT...i.....U.Rs.l.sJg...Y..2....~...I!s.e+..Ir./+q`...4.J.6..~=._..@.m.....T.C..:.toD.....M.tW?.P.....+....VE\U...O\|UuU.bu..~..$......d@u1..6.I.p.S.F...U.......M.....:..p...6E.....e.1.!..G...".....M...rP..F....b.Q..p..................p.?/.......BIu...8V...FM.w.....T..,..W'... v!...7.&...0.\S./.....x.....?.ZS......(..UAz5.....F....-.J..a5.......S!T...T..p...NR....\....8......z..........0%..>p?DQo!).ZQ.H...C..w...GC.n8..F@.1h.....].y.A..T.Q.I..0..#y..e.).F.&....W.=q8W..!=..g...3..\|.7.8P.`........d(..W..j.... ..$B1.}..YF...Q..... ....@.ZhK...?.5...K.2...%G.Ku.h...j.rRV.......Y.O.W!.S.i9..$.....u8.?.&.....g.X..}..r..............)J+..:.N_a../.c...."F\_...D..rV.....p5a....3>3yb..ga.(.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TreatmentsSecure\CoffeeContact.lnk

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Fri Aug 30 09:31:04 2024, mtime=Fri Aug 30 09:31:04 2024, atime=Fri Aug 30 09:31:04 2024, length=195072, window=hide
Category:	dropped
Size (bytes):	2556
Entropy (8bit):	3.8440426842542688
Encrypted:	false
SSDEEP:	48:8DD0Rf8GAdGCd29S89nJ93ZdGCBqqyp7EMD:8vofNqqy2
MD5:	DBF8E2678686F2B6E8321BE17F024C4D
SHA1:	7EEA30FDD88F25F5A34C9E8DE79CA722F0FE3A0B
SHA-256:	A539964C0E08A941150ECD2241845E97F76B3C09D75D996A36596EB9D81876E8
SHA-512:	B057F2C9698C2414C33676DB3823B8C62F860E0B0E719B5AAB9E93CC626E46D8671BD5D3D6019EB5A6C925A5C678D136DBE0AAB694360EB45EE05EF652107FE1
Malicious:	false
Preview:	L..................F.@.. ....#.......#.......#................................:..DG..Yr?.D..U..k0.&...&......vk.v....l.................t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.S...........................%..A.p.p.D.a.t.a...B.P.1......Y.S..Local.<......CW.^.Y.S....b.....................l.c.L.o.c.a.l.....j.1......Y.S..TREATM~1..R.......Y.S.Y.S..........................J...T.r.e.a.t.m.e.n.t.s.S.e.c.u.r.e.....x.2......Y.S .TREATM~1.EXE..\.......Y.S.Y.S.....7....................r-..T.r.e.a.t.m.e.n.t.s...S.e.c.u.r.e...e.x.e...........$.......$...5...........z.................0.....C:\Users\user\AppData\Local\TreatmentsSecure\Treatments?Secure.exe..C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.r.e.a.t.m.e.n.t.s.S.e.c.u.r.e.\.T.r.e.a.t.m.e.n.t.s...S.e.c.u.r.e...e.x.e.........T.r.e.a.t.m.e.n.t.s.S.e.c.u.r.e.>.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.r.e.a.t.m.e.n.t.s.S.e.c.u.r.e.\.T.r.e.a.t.m.e.n.t.s...S.e.c.u.r.e...e.x.e.7.C.

C:\Users\user\Desktop\CoffeeContact.lnk

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Fri Aug 30 09:31:04 2024, mtime=Fri Aug 30 09:31:05 2024, atime=Fri Aug 30 09:31:04 2024, length=195072, window=hide
Category:	dropped
Size (bytes):	2542
Entropy (8bit):	3.8463011130814357
Encrypted:	false
SSDEEP:	48:8fDORP0sGAdGCd29S89nJ93ZdGCBqqyp7EMD:8LGMdqiy2
MD5:	ABFB6E4094DB8F12509385011184660B
SHA1:	0D75A7233497FC352C960A87E876E862C332ABDD
SHA-256:	D505DBA8EDF97270ACD0E13DF4F7A69F1DBD0B87A4B0D865812E59015E3D0A8E
SHA-512:	8DD562F439318397609865FB71F9AD9C1456E816166AFC841C1B61E8E9C536A75526AFB116E3307D200BFEE28A3D867E8E5A223D246F4B5F3FA1A9304DF39C4C
Malicious:	false
Preview:	L..................F.@.. ....#......\|Z.......#................................:..DG..Yr?.D..U..k0.&...&......vk.v....l.................t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.S...........................%..A.p.p.D.a.t.a...B.P.1......Y.S..Local.<......CW.^.Y.S....b.....................a...L.o.c.a.l.....j.1......Y.S..TREATM~1..R.......Y.S.Y.S..........................r-..T.r.e.a.t.m.e.n.t.s.S.e.c.u.r.e.....x.2......Y.S .TREATM~1.EXE..\.......Y.S.Y.S.....7....................r-..T.r.e.a.t.m.e.n.t.s...S.e.c.u.r.e...e.x.e...........$.......$...5...........z.................0.....C:\Users\user\AppData\Local\TreatmentsSecure\Treatments?Secure.exe..C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.r.e.a.t.m.e.n.t.s.S.e.c.u.r.e.\.T.r.e.a.t.m.e.n.t.s...S.e.c.u.r.e...e.x.e.........T.r.e.a.t.m.e.n.t.s.S.e.c.u.r.e.7.....\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.r.e.a.t.m.e.n.t.s.S.e.c.u.r.e.\.T.r.e.a.t.m.e.n.t.s...S.e.c.u.r.e...e.x.e.7.C.:.\.U.s.e.r.s.

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.999001711301085
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	0039284903284902840932890840928091#U00aaharder.exe
File size:	18'312'192 bytes
MD5:	4a91d764fb5563b771d2a07d0d8a1181
SHA1:	4f8717d5f7aef12b3405be7bad1fb8c5c91df7b9
SHA256:	1cc3219cfd16bf9e2a0e8e276d2c5bba24a70f214d2301e760ba1a9424bf0504
SHA512:	c68c84c7d6d87e0f23c782b171f9e85e5eca687aa6e85125f2e7a13de5836b592c53ba0c296c29c93175a777c1fde9fbae671502284bf158ddb66466e7ccb726
SSDEEP:	393216:Driddy5sj6Lh8VpBdJ/cqa8PxzzVS9xvu6LQ0UhTWEJlZo1hadZ:qddusLVprdVaWzzY9xvug7U/JPKaf
TLSH:	9C0733805AC44534FC77113120DA67E2A9E5E67C4A270FEB36A02B1C9DBD8F85C27B67
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........X........................y.......................................................a...T.......T.Z.......2.....T.......Rich...

File Icon


Icon Hash:	13170f6d2d6d6d33

Static PE Info

General

Entrypoint:	0x40ab5c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5F70D7D7 [Sun Sep 27 18:20:07 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	e6f4169f2a5c3a8f93171d9f593bd22a

Entrypoint Preview

Instruction
call 00007FC8D4BD33FCh
jmp 00007FC8D4BD2D1Fh
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FC8D4BD2EFDh
mov dword ptr [esi], 0041F45Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0041F464h
mov dword ptr [ecx], 0041F45Ch
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FC8D4BD2ECAh
mov dword ptr [esi], 0041F478h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0041F480h
mov dword ptr [ecx], 0041F478h
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0041F43Ch
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007FC8D4BD460Ch
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0041F43Ch
push eax
call 00007FC8D4BD4657h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0041F43Ch
push eax
call 00007FC8D4BD4640h
test byte ptr [ebp+08h], 00000001h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2932c	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2c000	0x114bd04	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1178000	0x190c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x27720	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1f398	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1f000	0x1a4	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x28ef0	0xe0	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1d32b	0x1d400	723597f58d5674921108e642a8e1b5b4	False	0.5962540064102564	data	6.658318567238198	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1f000	0xacae	0xae00	fa1645fd03dda975b8bd67904b34af32	False	0.44526760057471265	data	4.948544868021258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2a000	0x1870	0xe00	f8724007e5d2ce85c65b5408a736d005	False	0.21484375	data	3.016754020922221	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2c000	0x114bd04	0x114be00	d623c5311d50ff24ee6f2d77cc421a43	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1178000	0x190c	0x1a00	fca0dc86189b5b127d85095ebd6abd95	False	0.7630709134615384	data	6.514362877721557	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
DATA	0x2c340	0x114901d	Zip archive data, at least v2.0 to extract, compression method=deflate	English	United States	1.0003070831298828
FLAGS	0x1175360	0xc	data	English	United States	1.6666666666666667
RT_ICON	0x117536c	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.21774193548387097
RT_ICON	0x1175654	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.11597472924187725
RT_ICON	0x1175efc	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.21774193548387097
RT_ICON	0x11761e4	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.11597472924187725
RT_STRING	0x1176a8c	0x418	data	English	United States	0.3148854961832061
RT_STRING	0x1176ea4	0x604	data	English	United States	0.21363636363636362
RT_STRING	0x11774a8	0x152	data	English	United States	0.5591715976331361
RT_GROUP_ICON	0x11775fc	0x22	data	English	United States	1.0588235294117647
RT_GROUP_ICON	0x1177620	0x22	data	English	United States	1.088235294117647
RT_VERSION	0x1177644	0x2d8	data	English	United States	0.45054945054945056
RT_MANIFEST	0x117791c	0x3e7	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (939), with CRLF line terminators	English	United States	0.5145145145145145

Imports

DLL	Import
KERNEL32.dll	LoadResource, FindResourceW, lstrlenW, GetProcAddress, GetModuleHandleW, DeleteCriticalSection, GetTempPathW, GetLastError, GetTempFileNameW, MoveFileW, WaitForSingleObject, GetExitCodeProcess, CloseHandle, DeleteFileW, GetModuleFileNameW, GetCurrentProcess, LoadLibraryW, FreeLibrary, InitializeCriticalSectionEx, GetFileAttributesW, CreateFileW, SetFilePointer, ReadFile, VerSetConditionMask, GetCurrentDirectoryW, MultiByteToWideChar, LocalFileTimeToFileTime, WideCharToMultiByte, CreateDirectoryW, WriteFile, SetFileTime, FreeResource, SizeofResource, LockResource, CreateProcessW, GetSystemDirectoryW, SetDefaultDllDirectories, GetCurrentThreadId, DecodePointer, RaiseException, LeaveCriticalSection, EnterCriticalSection, lstrcmpiW, LoadLibraryExW, GetConsoleMode, GetConsoleCP, SystemTimeToFileTime, VerifyVersionInfoW, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, IsDebuggerPresent, OutputDebugStringW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, ExitProcess, GetModuleHandleExW, GetStdHandle, HeapFree, HeapAlloc, GetFileType, CompareStringW, LCMapStringW, HeapSize, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableW, GetProcessHeap, SetStdHandle, GetStringTypeW, GetFileSizeEx, SetFilePointerEx, FlushFileBuffers, WriteConsoleW
SHLWAPI.dll	PathIsUNCW
COMCTL32.dll	InitCommonControlsEx

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	06:31:00
Start date:	30/08/2024
Path:	C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe"
Imagebase:	0x160000
File size:	18'312'192 bytes
MD5 hash:	4A91D764FB5563B771D2A07D0D8A1181
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:31:01
Start date:	30/08/2024
Path:	C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\0039284903284902840932890840928091#U00aaharder.exe" --rerunningWithoutUAC
Imagebase:	0x160000
File size:	18'312'192 bytes
MD5 hash:	4A91D764FB5563B771D2A07D0D8A1181
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:31:01
Start date:	30/08/2024
Path:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\SquirrelTemp\Update.exe" --install . --rerunningWithoutUAC
Imagebase:	0x230000
File size:	1'899'520 bytes
MD5 hash:	A560BAD9E373EA5223792D60BEDE2B13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:31:05
Start date:	30/08/2024
Path:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe" --squirrel-firstrun
Imagebase:	0x2cb8c990000
File size:	5'219'328 bytes
MD5 hash:	EF8AB76732B42F96F650419850193A0F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 13%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:31:06
Start date:	30/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	06:31:08
Start date:	30/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C cd "C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0" & start Treatments?Secure.exe
Imagebase:	0x7ff725b80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:31:08
Start date:	30/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f330000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	06:31:08
Start date:	30/08/2024
Path:	C:\Users\user\AppData\Local\TreatmentsSecure\app-1.0.0\Treatments?Secure.exe
Wow64 process (32bit):	false
Commandline:	Treatments?Secure.exe
Imagebase:	0x24fa18f0000
File size:	5'219'328 bytes
MD5 hash:	EF8AB76732B42F96F650419850193A0F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	06:31:16
Start date:	30/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C sc create MainSVCLine binPath= "C:\Program Files\Statistical Flexibility\MpDefenderCoreService.exe" start= auto & shutdown -r -t 0 -f
Imagebase:	0x7ff725b80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:31:16
Start date:	30/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	06:31:16
Start date:	30/08/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc create MainSVCLine binPath= "C:\Program Files\Statistical Flexibility\MpDefenderCoreService.exe" start= auto
Imagebase:	0x7ff68b940000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	06:31:16
Start date:	30/08/2024
Path:	C:\Windows\System32\shutdown.exe
Wow64 process (32bit):	false
Commandline:	shutdown -r -t 0 -f
Imagebase:	0x7ff743450000
File size:	28'160 bytes
MD5 hash:	F2A4E18DA72BB2C5B21076A5DE382A20
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	06:31:45
Start date:	30/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.4%
Total number of Nodes:	78
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00169CB3 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00169C96

Part of subcall function 0016A090: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0016A09B
Part of subcall function 0016A090: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0016A103
Part of subcall function 0016A090: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0016A114

Memory Dump Source

Source File: 00000000.00000002.1671475717.0000000000161000.00000020.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.1671438274.0000000000160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671951945.000000000017F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671978904.000000000018A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672009504.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672009504.0000000000B8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_0039284903284902840932890840928091#U00aaharder.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 56e52a2cdcd3ee5010491aac34c849b2ac31e28ffdb09b9245a658686c7b0306
Instruction ID: 82f8dd33671214907b6745b0c6ecf48676ff9cddfa2f76e1c861c5d273a1de18
Opcode Fuzzy Hash: 56e52a2cdcd3ee5010491aac34c849b2ac31e28ffdb09b9245a658686c7b0306
Instruction Fuzzy Hash: 42B0128525C5006F7109B1241E02D36038CDFC0B203B18C2BF504D9040DB400D100A33

Function 00169CD1 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00169C96

Part of subcall function 0016A090: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0016A09B
Part of subcall function 0016A090: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0016A103
Part of subcall function 0016A090: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0016A114

Memory Dump Source

Source File: 00000000.00000002.1671475717.0000000000161000.00000020.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.1671438274.0000000000160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671951945.000000000017F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671978904.000000000018A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672009504.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672009504.0000000000B8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_0039284903284902840932890840928091#U00aaharder.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 4536cce60406041abd467794a3dee458b9609e401091d08558717e9ec6acc2d6
Instruction ID: 4aa6ea48a28a9dea19dc5f42b9860a7f425e7a1ee84f82f82721d77202946723
Opcode Fuzzy Hash: 4536cce60406041abd467794a3dee458b9609e401091d08558717e9ec6acc2d6
Instruction Fuzzy Hash: 99B012C535C500AF7119B1145F02D36024CEFC0B203B1442BF000D9040DB401D510A33

Function 00169CBD Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00169C96

Part of subcall function 0016A090: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0016A09B
Part of subcall function 0016A090: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0016A103
Part of subcall function 0016A090: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0016A114

Memory Dump Source

Source File: 00000000.00000002.1671475717.0000000000161000.00000020.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.1671438274.0000000000160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671951945.000000000017F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671978904.000000000018A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672009504.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672009504.0000000000B8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_0039284903284902840932890840928091#U00aaharder.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 8c34da650660484b722b0f6fd0935914cefcfc3e33eb5960ae37f20da9f0c5a0
Instruction ID: cb691d6a97894fa96b13d603dd46e9eceea937c237974c5a011a90e8a4c80f20
Opcode Fuzzy Hash: 8c34da650660484b722b0f6fd0935914cefcfc3e33eb5960ae37f20da9f0c5a0
Instruction Fuzzy Hash: 02B0128625C5006F7109B1141E02D36038CEFC0B203B1482BF004D9040DB400D100A33

Function 00169CDB Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00169C96

Part of subcall function 0016A090: DloadAcquireSectionWriteAccess.DELAYIMP ref: 0016A09B
Part of subcall function 0016A090: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0016A103
Part of subcall function 0016A090: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0016A114

Memory Dump Source

Source File: 00000000.00000002.1671475717.0000000000161000.00000020.00000001.01000000.00000003.sdmp, Offset: 00160000, based on PE: true

Associated: 00000000.00000002.1671438274.0000000000160000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671951945.000000000017F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1671978904.000000000018A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672009504.000000000018C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1672009504.0000000000B8C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_160000_0039284903284902840932890840928091#U00aaharder.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 37da9226d182bfe40f82b93d8f81e6b01d20bed16041f519ad66a91145aeb46c
Instruction ID: 36d23eb610325c66bc5931a7fe237dd2eb33fc0669c4a48c82fb19f480a0c1fc
Opcode Fuzzy Hash: 37da9226d182bfe40f82b93d8f81e6b01d20bed16041f519ad66a91145aeb46c
Instruction Fuzzy Hash: DBB0128535C5006F7119B1141E02D36024CFFC0B203B1482BF000D9080DB401D500A33

Analysis Process: Update.exePID: 6544, Parent PID: 6444COMMON

Executed Functions

Function 00007FFD9B8B0F18 Relevance: 3.5, Strings: 2, Instructions: 957COMMON

Download Yara Rule

Strings

rR_H, xrefs: 00007FFD9B8B308D
wR_H, xrefs: 00007FFD9B8B2B93

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID: rR_H$wR_H
API String ID: 0-4051466527
Opcode ID: 1909a5f0223740940a9f1fa06082fa47d7b8d80056b77ff8cd1f0366666d6853
Instruction ID: 2cb621fd586d6e2cfa462343b34d180db7461edf62c6b28fdcf25dc074b58672
Opcode Fuzzy Hash: 1909a5f0223740940a9f1fa06082fa47d7b8d80056b77ff8cd1f0366666d6853
Instruction Fuzzy Hash: E4424A21B1D91E0FE7689BBCA86167977D1EF98310F15027AD05DC32E6ED28684387C1

Function 00007FFD9B8B0F25 Relevance: 2.9, Strings: 2, Instructions: 425COMMON

Download Yara Rule

Strings

3L_^, xrefs: 00007FFD9B8B1101
4L_^, xrefs: 00007FFD9B8B1001

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID: 3L_^$4L_^
API String ID: 0-4024852540
Opcode ID: be3260c49944b4710d14a8c41c399a149ea9ad47993e293200684608e0d54664
Instruction ID: 2089c368938d81aeded8100c1d516defab68133313efea206ed19ef012e6fdf4
Opcode Fuzzy Hash: be3260c49944b4710d14a8c41c399a149ea9ad47993e293200684608e0d54664
Instruction Fuzzy Hash: 78C10963F096764BD71AB7BCB8B64E93B90DF0223C70941B7C0DD8A0A7ED18644B86D5

Function 00007FFD9B8D313D Relevance: 1.2, Instructions: 1156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b302dab3208f372f5b1e7879dec2771b9d4fbbc01a6ce5a493a3b50133d1cc3
Instruction ID: eb1619e33d1dec22ccbed977d14c4920d7d1bcbf912137a81ad9196f12dc52d9
Opcode Fuzzy Hash: 8b302dab3208f372f5b1e7879dec2771b9d4fbbc01a6ce5a493a3b50133d1cc3
Instruction Fuzzy Hash: 7E82BF70A19B0A8FD768DF18C491575B7E1FB98314B24466EC0CBC7AA2DB35F8438B81

Function 00007FFD9B8B8A08 Relevance: .6, Instructions: 644COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f62f229a6727fc3e2ac1eaf9d7b934dd859e9e50872e28dd6134f189c40ffcd4
Instruction ID: 37e9b61ce63ed74ea4633cf77f72614e7c24d8d21dfa58d98c3b871fb7709506
Opcode Fuzzy Hash: f62f229a6727fc3e2ac1eaf9d7b934dd859e9e50872e28dd6134f189c40ffcd4
Instruction Fuzzy Hash: 30122B31B1D9194FE798EB7C9865A7933D1EF98310F4101B9E40EC72E6DE29EC428781

Function 00007FFD9B8D4D65 Relevance: 4.0, Strings: 2, Instructions: 1511COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00007FFD9B8D4FED
S=, xrefs: 00007FFD9B8D4DCA

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID: VUUU$S=
API String ID: 0-1958660053
Opcode ID: d70a0b983d482a20088b68c4effe74358ba59b714e46ba1403a318e2f0233c71
Instruction ID: acfdd0da80c6c31f69f7f0b4a0fae0091f128e42ac439b35ec0bad1a598cfd02
Opcode Fuzzy Hash: d70a0b983d482a20088b68c4effe74358ba59b714e46ba1403a318e2f0233c71
Instruction Fuzzy Hash: 83B2EE70A2974A8BD72DCF58C4915B9B7E1FB89300F15477EC8DB83696DA34B8138B81

Function 00007FFD9B8B87FA Relevance: 2.7, Strings: 2, Instructions: 172COMMON

Download Yara Rule

Strings

K_^f, xrefs: 00007FFD9B8B882A
K_^V, xrefs: 00007FFD9B8B87FA

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID: K_^V$K_^f
API String ID: 0-11049692
Opcode ID: 3a989f6f99ad025418e65260b886bf84d529448e723c43c4650b1f768fea2ce8
Instruction ID: 06477113ebba821d4e2d601d7ab5a39629fff7079fa08af4fe9100fd2b0b6661
Opcode Fuzzy Hash: 3a989f6f99ad025418e65260b886bf84d529448e723c43c4650b1f768fea2ce8
Instruction Fuzzy Hash: 03519062B0F2D94FE762A7B958655D87F90EF45365B0901FFC098CB0E3E918690683C2

Function 00007FFD9B8B60FB Relevance: 1.8, Strings: 1, Instructions: 545COMMON

Download Yara Rule

Strings

K_^, xrefs: 00007FFD9B8B6101

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID: K_^
API String ID: 0-3865075263
Opcode ID: 0e13d31989bb6be25b241a41104368cb92d5b37f0ee70c073efa88d8b8766864
Instruction ID: 0c7a13305035493b98dc2192431165d9c69fdeb555c54cb7a65339482bbf9134
Opcode Fuzzy Hash: 0e13d31989bb6be25b241a41104368cb92d5b37f0ee70c073efa88d8b8766864
Instruction Fuzzy Hash: FFE17C93F0F96A0BF36567BCB8654E9BB90EF98264B0502B7D05CC70E3EC18A54786D0

Function 00007FFD9B8B0E30 Relevance: 1.7, Strings: 1, Instructions: 453COMMON

Download Yara Rule

Strings

K_H, xrefs: 00007FFD9B8B3970

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID: K_H
API String ID: 0-313846638
Opcode ID: 1d7490507dfc8bc0525ce1c7fc779520fa06cf0dd7ec5c54a781cc67405e0257
Instruction ID: 74865558455f560610c6641080d8318febfb207f75fdd2de89a68ea8ae904adf
Opcode Fuzzy Hash: 1d7490507dfc8bc0525ce1c7fc779520fa06cf0dd7ec5c54a781cc67405e0257
Instruction Fuzzy Hash: 3CD1A03070DA598FD7A8EB2CD46996577E2FF9831071501BED04EC72A6DE25EC82CB81

Function 00007FFD9B8C91AD Relevance: 1.7, Strings: 1, Instructions: 439COMMON

Download Yara Rule

Strings

__L, xrefs: 00007FFD9B8C94F1

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID: __L
API String ID: 0-251012315
Opcode ID: 468bd3143aec2fcb33ddaec8a9dfa502d5f28a25eab575eedc15ad70f016f6e5
Instruction ID: 81f4ed52af3b1548cf97fcd06983fdf550256370204d2ddf26d0015ae79d63f2
Opcode Fuzzy Hash: 468bd3143aec2fcb33ddaec8a9dfa502d5f28a25eab575eedc15ad70f016f6e5
Instruction Fuzzy Hash: B1D12971B0DA4D4FEB99EB6C88699B877D1EF99304B0505BED05DC72E2DE24A842C700

Function 00007FFD9B8CA1D3 Relevance: 1.6, Strings: 1, Instructions: 373COMMON

Download Yara Rule

Strings

X, xrefs: 00007FFD9B8CA23C

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID: X
API String ID: 0-3081909835
Opcode ID: 5d1058c67378e9c79d5f0d6829ed5a49a83246a34e16d43ce90f51cf7377ab70
Instruction ID: 2e99f77fd2184aa8d2b83ceea4ab28812f51d03f0582b3f817c94222f12861a9
Opcode Fuzzy Hash: 5d1058c67378e9c79d5f0d6829ed5a49a83246a34e16d43ce90f51cf7377ab70
Instruction Fuzzy Hash: 62B18761B0EA9E0FE76AF77C68655F53B91EF9531470501FBD08DC71ABEC28A8068340

Function 00007FFD9B8CC7F0 Relevance: 1.6, Strings: 1, Instructions: 363COMMON

Download Yara Rule

Strings

PK00, xrefs: 00007FFD9B8CC925

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID: PK00
API String ID: 0-1863955648
Opcode ID: 29236bc4945caf4d8a6fd3d5cf73a89858016e0e85225f580a232353132f1930
Instruction ID: 785a1540f0795e640e7947bd267a56964e11419861a746d49866aa74c5a10a68
Opcode Fuzzy Hash: 29236bc4945caf4d8a6fd3d5cf73a89858016e0e85225f580a232353132f1930
Instruction Fuzzy Hash: 36A1B2A1B199494FE7B8E75CA46867973D1EF9C710F0640BBE04EC32A6DD24AD428BC1

Function 00007FFD9B8C4C64 Relevance: 1.6, Strings: 1, Instructions: 356COMMON

Download Yara Rule

Strings

TQ_H, xrefs: 00007FFD9B8C4E91

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID: TQ_H
API String ID: 0-1299286871
Opcode ID: 5a6c215374f306cde27be308e256e04c893f4a62b00b78ff12450912b0e1cfba
Instruction ID: 11cf3e2321df757eebae5bec67b2c9fd77a758676f85af5f3bf1784e12bb3a5e
Opcode Fuzzy Hash: 5a6c215374f306cde27be308e256e04c893f4a62b00b78ff12450912b0e1cfba
Instruction Fuzzy Hash: 2C91F7A2B1EE4D0FEBA9A76C54651B827D2EF9C350B0A017FE45DC32E7DE196D424380

Function 00007FFD9B8B3A69 Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

K_H, xrefs: 00007FFD9B8B3B74

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID: K_H
API String ID: 0-313846638
Opcode ID: 568945748613553330114916e9d7f5ebf117a24bbef1e9f7ca1b23b40cd4ec59
Instruction ID: 350956baeaa99033f5eaa73ae4944889e072f91c5560fc62d14a4a04a149f167
Opcode Fuzzy Hash: 568945748613553330114916e9d7f5ebf117a24bbef1e9f7ca1b23b40cd4ec59
Instruction Fuzzy Hash: 85512521B0EA4A1FE7A4DB788465A7577E1EF99310B1901BFC04DC71E6DE28AD468B80

Function 00007FFD9B8B87F8 Relevance: 1.4, Strings: 1, Instructions: 192COMMON

Download Yara Rule

Strings

K_^f, xrefs: 00007FFD9B8B882A

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID: K_^f
API String ID: 0-2321079578
Opcode ID: c88d724f3ef664c151bb592cac6fc52b0263c5c501e0bdb1bb76949cdaaed36a
Instruction ID: 8e5877bee8caa051610ad44f3f073bfaabb431e928a0d131fbdb452807c40a25
Opcode Fuzzy Hash: c88d724f3ef664c151bb592cac6fc52b0263c5c501e0bdb1bb76949cdaaed36a
Instruction Fuzzy Hash: DB515B31B1951D4FDB68EB999826AF97BD0FF98311F08027FD05EC32A2DD24A90687C0

Function 00007FFD9B8B8800 Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

K_^f, xrefs: 00007FFD9B8B882A

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID: K_^f
API String ID: 0-2321079578
Opcode ID: d62996bcdb6f771f25d2d4f63de66ae973aa51b796b8a5cfa154ab6e53165f37
Instruction ID: 1569233a8195c9670ff09a00238021afb136177f37655baafb3b45ac7e5dfb0b
Opcode Fuzzy Hash: d62996bcdb6f771f25d2d4f63de66ae973aa51b796b8a5cfa154ab6e53165f37
Instruction Fuzzy Hash: DC213A22B1941A4FE738F699685A6E867C0EB88376B09027BD11DC32A2EC586D0782C0

Function 00007FFD9B8BD888 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

N^, xrefs: 00007FFD9B8BD894

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID: N^
API String ID: 0-4154041124
Opcode ID: 67f1bbe57e77e56121a48c41e73db48e5b16824bd37a30724cf21510c3304032
Instruction ID: 7cf9079d647749619fd0ba4d8c952fe4f4f65064eac37b6b08ced1f5c12328eb
Opcode Fuzzy Hash: 67f1bbe57e77e56121a48c41e73db48e5b16824bd37a30724cf21510c3304032
Instruction Fuzzy Hash: DF214B31E0EA9A5FEB95ABBC48251E87BF0EF19310B5404BBD45CC71D6DE38A94287C1

Function 00007FFD9B8C8193 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

cJ_^, xrefs: 00007FFD9B8C8193

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID: cJ_^
API String ID: 0-326316387
Opcode ID: 5db932ea538457b0cf736662b1ea1733f7913d7ccecb38f33e135f2ada9a561a
Instruction ID: 8e8964a0227e05a511e366d35136b8cd318cdc37846134f33f6a7d931cad6202
Opcode Fuzzy Hash: 5db932ea538457b0cf736662b1ea1733f7913d7ccecb38f33e135f2ada9a561a
Instruction Fuzzy Hash: FD118192F8AC5F4AFBB4BB9858395F972C0EF8C310F470177E41D824E2DD186A070581

Function 00007FFD9B8BE9CC Relevance: 1.0, Instructions: 960COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d6cf719f989ecf21cfe713bcc34ec33c07521141f9a5fdaae85ea9074ce863f
Instruction ID: 4a94e66520a0b032e75a1fac3fc77c94ea13b45b2d1472fcf97a3576a56f5904
Opcode Fuzzy Hash: 0d6cf719f989ecf21cfe713bcc34ec33c07521141f9a5fdaae85ea9074ce863f
Instruction Fuzzy Hash: 1662A431B1995E4FDB98EF68C4A4AB973E1FF98300F1545A9D41DC32E6DE34A942CB80

Function 00007FFD9B8C1962 Relevance: .8, Instructions: 767COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2410719be217bfb53309108851789f3fd269b3fdf0310a99ef1138ad57748f8
Instruction ID: 081f261539c0526166331d9248c7a0be61c6c2bd696104866168340ad9f2c02e
Opcode Fuzzy Hash: a2410719be217bfb53309108851789f3fd269b3fdf0310a99ef1138ad57748f8
Instruction Fuzzy Hash: 9F2258A2B1EE4E0FE7A9B76C68B11B437C1EF99750B0541BBD44DC32E7ED18AD024281

Function 00007FFD9B8D13E5 Relevance: .7, Instructions: 659COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 898aca04a7223bcdaaaf8706f945535941fd2fdb8838f668181e0c0babcaac83
Instruction ID: 466b2f08af22acfdb372a1fac535fb99be07d43e09a3a21920e0c4cb3a5635b0
Opcode Fuzzy Hash: 898aca04a7223bcdaaaf8706f945535941fd2fdb8838f668181e0c0babcaac83
Instruction Fuzzy Hash: F9120631B1AA494FE7B8E768946567577D2FF98300F0507BED08EC32E6DE28AD428740

Function 00007FFD9B8B1375 Relevance: .6, Instructions: 616COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d55935febc2d82c2548ed7fb0a6a67b1260cb4b317a43151e048dd7b9efd74e
Instruction ID: a1bbdf1fca725941fd039cd44f49d496e2280d87b2792f499ea11e5cd4bb9a11
Opcode Fuzzy Hash: 8d55935febc2d82c2548ed7fb0a6a67b1260cb4b317a43151e048dd7b9efd74e
Instruction Fuzzy Hash: 0B127C1272EAD91FDBA9AB7C8465D783BC1DF69340B1900BED08DC71D3DD18A94A8781

Function 00007FFD9B8B8542 Relevance: .6, Instructions: 554COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57e2f7a4c79e49dbe8da53c670e8d419f1fc586447e44e70634a9ba6474b70bb
Instruction ID: c5a39152aaa4c1f55d778b9ce93f764b0e1413a8378258a7e38a820249b65983
Opcode Fuzzy Hash: 57e2f7a4c79e49dbe8da53c670e8d419f1fc586447e44e70634a9ba6474b70bb
Instruction Fuzzy Hash: 09F18B3160EA8D4FD769DB7C88259B57BE1EF5A310B0A02FAD05DC71E3DD28A90687C1

Function 00007FFD9B8D75C9 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85a259267c7a99f6ac20a38c5687c91dfe84d76c66d96fe7c8337a5337fa66f9
Instruction ID: 4484e86c12f03837bf646b94dcc4fe77d5c8c910ab567d81defce2d3a3a6237a
Opcode Fuzzy Hash: 85a259267c7a99f6ac20a38c5687c91dfe84d76c66d96fe7c8337a5337fa66f9
Instruction Fuzzy Hash: 54D12821B0EE8E0FEBA9976C98656757BD1EFA9250B0503BBD44DC71E7ED18ED028340

Function 00007FFD9B8BFF30 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1426a2d658cbf986d58a2ba8438f4e32151d509630ed51909c8fc88e984e7de5
Instruction ID: ee158a5fc0e77149e8cb8f900689c69cf2f0bbe31fb386a71ee5222228fbf687
Opcode Fuzzy Hash: 1426a2d658cbf986d58a2ba8438f4e32151d509630ed51909c8fc88e984e7de5
Instruction Fuzzy Hash: CDD13B52A1F7DA4FE756B77C68B54F83B90EF4666870902FBD0D88B1E3EC0869478241

Function 00007FFD9B8C00D3 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91cad0fddee809f17c9e12d9aea78daba964f6d19ab4fa6fcf3d4cc451644894
Instruction ID: 2f37d96671bb063abbce5ded8f68a9d15f20b2bfb220cb34fc3ad4a7ae7e2a16
Opcode Fuzzy Hash: 91cad0fddee809f17c9e12d9aea78daba964f6d19ab4fa6fcf3d4cc451644894
Instruction Fuzzy Hash: BAC15DA3B1FA9A0FE7AAA76C68751B57BD0EF5966470902FBD08DC71E3EC046D074240

Function 00007FFD9B8BC567 Relevance: .5, Instructions: 454COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e4915e81aad3a1dc0b90276190d4398e7b418c320dd42cc20b7ad9f1afa1c72
Instruction ID: 443375cd1cd024dd2842dc8567a10229312579f353ef5bbdac48ac08cf498af0
Opcode Fuzzy Hash: 3e4915e81aad3a1dc0b90276190d4398e7b418c320dd42cc20b7ad9f1afa1c72
Instruction Fuzzy Hash: CAE13831A09A5D8FDB98DF68C865AEA77E1FF9D310F14017ED419C72A1DA34A902CF81

Function 00007FFD9B8C98D8 Relevance: .4, Instructions: 419COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd390f00713b3cbdb90166ccb4cb9e952d7d2b7aa53577300116277bf2b47ddb
Instruction ID: 962c577f8b165f695501da9a1652c3e95ee685bee49847c32955ed0e35e8951b
Opcode Fuzzy Hash: fd390f00713b3cbdb90166ccb4cb9e952d7d2b7aa53577300116277bf2b47ddb
Instruction Fuzzy Hash: 48B12871B0DA0E0FEBA8EB2C94615B573D1EF99310B0501BBD44EC31E7EE25AC468781

Function 00007FFD9B8C2DA3 Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd4994076979e826721e25c669f09c3b9aa75952df9d5cb8494eef44ee2354e0
Instruction ID: b451333f71b3769b20c7ba40a231dc9917dd9b36e84b8dfe33aaede0fd10cdbe
Opcode Fuzzy Hash: dd4994076979e826721e25c669f09c3b9aa75952df9d5cb8494eef44ee2354e0
Instruction Fuzzy Hash: 40D13971A09A4E4FDB95EF68C861AFA77F1FF59300F1102AAD459C71E6CA34E902C781

Function 00007FFD9B8B191E Relevance: .4, Instructions: 391COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4223d981ebb7f872a3c759248f0ddb9b6d0b99e295ea77bfcfafb94268994d91
Instruction ID: b244c59c806e5d053d4f5d69e4ff61b9f322768e4f1332d9b8ca6f9e0fbe47c5
Opcode Fuzzy Hash: 4223d981ebb7f872a3c759248f0ddb9b6d0b99e295ea77bfcfafb94268994d91
Instruction Fuzzy Hash: A3C14A5272EDD90BEBA8BF7C8465E743BC1DF68780B1400BED189C71D3DD18A94A8781

Function 00007FFD9B8BE280 Relevance: .4, Instructions: 377COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fffb813ef771bc593291d7202b6a9b59cde9c20f6ca2678a027417a465b79da8
Instruction ID: 2bb348fd33e37440bad528087b28bf339e08f3a8fbe0e3b6166db3e04eb7cc88
Opcode Fuzzy Hash: fffb813ef771bc593291d7202b6a9b59cde9c20f6ca2678a027417a465b79da8
Instruction Fuzzy Hash: 8CB14721B1DA494FE798FB7C98A9A7977D1EF9C210B0501BBE40DC72E7DD29AC428341

Function 00007FFD9B8CB580 Relevance: .4, Instructions: 377COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 259a1520457a7b9317ce1f3c500b7edbaa7e7a6df093c0f7d6c035c5bde882cc
Instruction ID: 3d21950154a616c9f0c5d7018756d8cb75e2131c73dbfc6ea8860cadfc65308f
Opcode Fuzzy Hash: 259a1520457a7b9317ce1f3c500b7edbaa7e7a6df093c0f7d6c035c5bde882cc
Instruction Fuzzy Hash: 6FC16130715E4D8FDBA8EB2CC4A8A75B7E1FF5831171241AAE05EC76B6DA24EC41CB41

Function 00007FFD9B8BEC94 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a22534fbfbfde5532677d5f1e76a93b94542c7185e3cc8323e2922487a4fc43
Instruction ID: 35acb460dac55cf8bb8151846b8baa8821268c2886c3c6c61d5c76caae0f6b17
Opcode Fuzzy Hash: 6a22534fbfbfde5532677d5f1e76a93b94542c7185e3cc8323e2922487a4fc43
Instruction Fuzzy Hash: 44C13130B1995D8FDBD8EF68C8A4B6973E1FF58304F1545A9D41AC72E5DA34E842CB80

Function 00007FFD9B8C825C Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fada7d4554d735da9cefff4b18a141481f2628b472ab7d5eb3a5994a008ef71
Instruction ID: a16a09dd804a054d3cfbf22d303a1638813d8d6fe027c507b7c3e86ce22e3e42
Opcode Fuzzy Hash: 0fada7d4554d735da9cefff4b18a141481f2628b472ab7d5eb3a5994a008ef71
Instruction Fuzzy Hash: A9C1B430619A4D8FDB98EF28C854AB973E2FF98304B544569D41DC72A6CB35E842CB40

Function 00007FFD9B8CCBB5 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f3fcaa70542b83b1b5636992a79f1ea56229b00b7f2e711a06b3d547c0c5cfc
Instruction ID: 3e41855f1c5ac452f09e97ef728a388fcb003a9ca0f3062fd5aba5c3c3c2366e
Opcode Fuzzy Hash: 3f3fcaa70542b83b1b5636992a79f1ea56229b00b7f2e711a06b3d547c0c5cfc
Instruction Fuzzy Hash: 02B17270719E494FD7A8EB2CC4A8A35B7E1FF5831131641ABE08EC76B6DA24EC41CB41

Function 00007FFD9B8B2000 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bffb304a90316854fe856c73a4554c242fb2eb9ab9a3188c12de81bed64ba371
Instruction ID: e21ef65072cbc1b9e625b8d668b9b3c276519a6a9852f8288d091dbe28d0e8be
Opcode Fuzzy Hash: bffb304a90316854fe856c73a4554c242fb2eb9ab9a3188c12de81bed64ba371
Instruction Fuzzy Hash: 9EA16962B19A5E0FE7B89BBC646667567C1EF9C350F0501BEE01DC32E6ED18BD428780

Function 00007FFD9B8BED66 Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e7496b518ce9d540f38047034ea4618b60c6cf2c97e6645a503b7a97b28c9ec
Instruction ID: 6af7d21cd78db93102c801b1de53d1c75554a2ea3af22ab99d889348d96c1641
Opcode Fuzzy Hash: 4e7496b518ce9d540f38047034ea4618b60c6cf2c97e6645a503b7a97b28c9ec
Instruction Fuzzy Hash: B5B13230B1995D8FDBD8EF68C8A4A6973E2FF58300F1545A9D41AC72A5DE34E842CB80

Function 00007FFD9B8D7D68 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cac7c633e25b9bedf425718eab54798c3f8e36c9823327c9a682403ac54abfe4
Instruction ID: 1f5c2d6b2cc086232c1f971afee43254c8335cc36df7a527838f22b89a665475
Opcode Fuzzy Hash: cac7c633e25b9bedf425718eab54798c3f8e36c9823327c9a682403ac54abfe4
Instruction Fuzzy Hash: 89A14735A09A8E4FEBA4DF6488255E977E1FF89310F0503BFD41DC71E2DA25A9068782

Function 00007FFD9B8CE979 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a3f7cfd6a371409bd9f57d6f58fdccbe024f646f8ffec219d1471f0403d8db6
Instruction ID: 549ed994120ac3bf52bc6ac0f7a4a6352071830a2a1088b0a0210624b99212b6
Opcode Fuzzy Hash: 9a3f7cfd6a371409bd9f57d6f58fdccbe024f646f8ffec219d1471f0403d8db6
Instruction Fuzzy Hash: BAA1B371719E098FD7A8EB6CC468A7573D1FF5D311B0506BAE04EC76A2DE28F8418740

Function 00007FFD9B8B9C35 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab01d5e52cb47c42fa79d26bfbe539bbd5ea93e4a18ec6a6503462233c1259e6
Instruction ID: c3074b48e2b2766cce1776b9773f4ca0d918bd0b18c0265db4c7f7447ac1968a
Opcode Fuzzy Hash: ab01d5e52cb47c42fa79d26bfbe539bbd5ea93e4a18ec6a6503462233c1259e6
Instruction Fuzzy Hash: 8F918B12B0EEAE0FEBA9977C58B81B467C1EF5835071945FAC05CC71EBED24AC428781

Function 00007FFD9B8B0DC8 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c93b7b522df736c6e301ef2a607a553baf51e83cd1b383e0b785e126e0752cb
Instruction ID: 45abff639475f6200e711998c78ea84e260e3c1d43f4eccb59cb29719508aeac
Opcode Fuzzy Hash: 0c93b7b522df736c6e301ef2a607a553baf51e83cd1b383e0b785e126e0752cb
Instruction Fuzzy Hash: 33914621B1DA5D0FE72D9BA8A8655B57BD1EF59310F0142BED08EC31E7ED28688387C1

Function 00007FFD9B8C4B68 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e55ef114d222045cf2a24472844d7cb761c6bd755432616f4147dce1c9887cb4
Instruction ID: a2c88aa75d6074bbc32e44864946295a5d095e6f46147f1318fc41289f0773f5
Opcode Fuzzy Hash: e55ef114d222045cf2a24472844d7cb761c6bd755432616f4147dce1c9887cb4
Instruction Fuzzy Hash: 5C912A71B0DA8D0FEBA5FF6888655B937E1EF59310B0502BED05DC31A3DE28AD468780

Function 00007FFD9B8BF585 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfecf6fe9da31bfa67aca3502b4216d171107ffea5978fb5b3ad5764cd1d2046
Instruction ID: 055089129c314b51c93861f56f7a29e711f4b088b06c7e83860acae0308f4536
Opcode Fuzzy Hash: dfecf6fe9da31bfa67aca3502b4216d171107ffea5978fb5b3ad5764cd1d2046
Instruction Fuzzy Hash: 62B11430A0D6DE4FDB95DF74C8206FA7BE1FF4A310F0505AAD459CB1A7CA299906CB81

Function 00007FFD9B8B8245 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4865eb027a9669bf58bc15b3ff143527bf73c912670daaaa9ba810c78ebf2f85
Instruction ID: ed33abb61838cdaec6e9857efced851a86bfd8db53c5b2dc217921d10ad51f53
Opcode Fuzzy Hash: 4865eb027a9669bf58bc15b3ff143527bf73c912670daaaa9ba810c78ebf2f85
Instruction Fuzzy Hash: D1A16A71B1EA8E4FDB98EB7888659A97BA1FF98300B0441FED059C71D6DD24E8078780

Function 00007FFD9B8C70FB Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faa82e5d0d884e52f15dbe03e51a04fa797e7f2cd674a18efb1f8ddbbffb3742
Instruction ID: 2d4a05ed40d45b72239961ed2f236e5ddb0ceffcd99ef3eec4a50cd9b061a6c6
Opcode Fuzzy Hash: faa82e5d0d884e52f15dbe03e51a04fa797e7f2cd674a18efb1f8ddbbffb3742
Instruction Fuzzy Hash: 6A914776B0861A8FDB49FF6CE8659E93790EF98334B08417BD09DCB197D924A846C780

Function 00007FFD9B8BF31C Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f49009e47e78d90fb1f9008de032e09251f1b086ada4f0228413b52404d3deb9
Instruction ID: ad2594053f8acd3b706f4200d09655dd41b3b82b7a5b1b972c4c8f01f4b90fb5
Opcode Fuzzy Hash: f49009e47e78d90fb1f9008de032e09251f1b086ada4f0228413b52404d3deb9
Instruction Fuzzy Hash: 8291FA21F19D5E4FEB98EB6C84A56B873D2EFA8340B1141B9D41DC32E7DD24AD428B80

Function 00007FFD9B8CB80D Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba9e17d0961a5f77b751c3a8ade0fc389f3a2efab78f968d0ba603bd95035a6d
Instruction ID: 4896a6ae9a3217f5763a925ccc8eec2fc14f5a1e7700971d5b22b5a29fd1fb56
Opcode Fuzzy Hash: ba9e17d0961a5f77b751c3a8ade0fc389f3a2efab78f968d0ba603bd95035a6d
Instruction Fuzzy Hash: 90A1D5B1709E4E8FDBA8EF5888A55B533A1FF9C344B11416AD45EC72A6EE31EC02C740

Function 00007FFD9B8C582D Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1f6276a5bceaf62cb28bc40572405981b9260518d08eb10a7d63dc87e53953d
Instruction ID: 57fd3cb7c88cdb3d106e48428c147371e0119483589d894cfd5191e794f56c43
Opcode Fuzzy Hash: a1f6276a5bceaf62cb28bc40572405981b9260518d08eb10a7d63dc87e53953d
Instruction Fuzzy Hash: 51A1537171894D8FDF98EF58C8A5AB973E1FFA8304F10416AE40EC7295DA35E842CB40

Function 00007FFD9B8CB808 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef7e69bee41367d4bdcd824ab86e512baa3b6de0b09400a67e9073732c99d9b5
Instruction ID: cbd2535bc0d026e520146478c8c56d1bb7dd0e08984784b2a6d43f9df35eb084
Opcode Fuzzy Hash: ef7e69bee41367d4bdcd824ab86e512baa3b6de0b09400a67e9073732c99d9b5
Instruction Fuzzy Hash: 3F919D70705E494FDBA8EB2CD468A74B7E2FF6831171541ABE04AC72B2EF24EC458741

Function 00007FFD9B8C2920 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34eb225acae635c04e66aba19d46be7fc354dcd81c79d60cdda88f553980273f
Instruction ID: e92fc2bc0effac4c8dcbcc797b76376a1a9b868b9544304590e8f9324b3dd1de
Opcode Fuzzy Hash: 34eb225acae635c04e66aba19d46be7fc354dcd81c79d60cdda88f553980273f
Instruction Fuzzy Hash: 08912771A09A4E4FEBA4EF688861AB577E1FF9C310F09417BD41DC3196CE24A986C780

Function 00007FFD9B8B5770 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da448aad130efa57e41f6c653ed25b90e8e4525b9f4fdb2ed0cf5fe7553b3967
Instruction ID: ee88e3e67dd3bdcfa95c94b072d29ff6c412ec30481696f5a463366003247895
Opcode Fuzzy Hash: da448aad130efa57e41f6c653ed25b90e8e4525b9f4fdb2ed0cf5fe7553b3967
Instruction Fuzzy Hash: C3816931B0DE5A4FE798EB2C98B15A677D1EF98350B04457EE05DC32EBDD24E8028B81

Function 00007FFD9B8CEEA5 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73b150560fca3e740216f9e1d3b860b49e7cd104e0903328afd2f2e6ed05d611
Instruction ID: cb1040b622c80a3ad31e5a41cc26806cbbc934ce8fac48b10780eaa484f0539a
Opcode Fuzzy Hash: 73b150560fca3e740216f9e1d3b860b49e7cd104e0903328afd2f2e6ed05d611
Instruction Fuzzy Hash: 96817E70705E494FD7A8EB2C9468A74B7E2FF6831171641ABE08AC76B2DB24EC41C741

Function 00007FFD9B8BD21D Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80272298f7c47ee1484409736e76e8d9dfd8703e905edf2498f5df58d6aed2d9
Instruction ID: fa6d48424c466f5db927337f28bddc097259a73eeb653f6d287929eef1e9909f
Opcode Fuzzy Hash: 80272298f7c47ee1484409736e76e8d9dfd8703e905edf2498f5df58d6aed2d9
Instruction Fuzzy Hash: BF819D22B0EACE1FF769A77858655A87BA0EF69350B0502FBD04DC71E7EC186C478781

Function 00007FFD9B8CFB15 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c35c9aa3622cd0f2f35eae3bb604fa8a7192ec01476c00c6593cfd3428a5af61
Instruction ID: 7169e6359d552a79d9fcd67bf8f84aa6ad26f32d765f7c650bdcbf44dd876c21
Opcode Fuzzy Hash: c35c9aa3622cd0f2f35eae3bb604fa8a7192ec01476c00c6593cfd3428a5af61
Instruction Fuzzy Hash: 2881E961B0E98D0FEBA5EB6C58656B937D1EF9D350F0601BBE44DC32A2DB186D058381

Function 00007FFD9B8B67F2 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 024db9bd5145b702e334046737b2ac5b2f0aea29d38cb7e17e22e5139263a03c
Instruction ID: 6b499b89c2cc8f084e4a15ec82c43d91b318cee5056e8d17191a145f95dc3ab2
Opcode Fuzzy Hash: 024db9bd5145b702e334046737b2ac5b2f0aea29d38cb7e17e22e5139263a03c
Instruction Fuzzy Hash: 33814962B0E7D94FEB5997B89C719A8BBE1EF59210B0501FBD04CC71E3DD18B8068791

Function 00007FFD9B8D8099 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c8fdf589a914b814b809dc0519df698745c9a057efeaa457a752f3cd7d79a31
Instruction ID: a2fe7fd76af83c9e4d1ae383606e0f4428fe16de9b6d0d4df9f97ea5b1881ea7
Opcode Fuzzy Hash: 6c8fdf589a914b814b809dc0519df698745c9a057efeaa457a752f3cd7d79a31
Instruction Fuzzy Hash: B3712772A0DA0D4FEB98EB5C9859AB577D1FFD9321B14037BD40DC31A2ED28A9478780

Function 00007FFD9B8C41A7 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9800d405ec0e35c09df37c9f200bc9db04cee3fff33830c487fea45a001540d
Instruction ID: 057494a2ac63d76b0b94669fb0dea2aa947682eaa47af33a0b3404ddd4ffe40e
Opcode Fuzzy Hash: e9800d405ec0e35c09df37c9f200bc9db04cee3fff33830c487fea45a001540d
Instruction Fuzzy Hash: AA819A71A09A0D8FDB98EF58C8A4AB977E1FF98314F15466ED41DC7295CB30E881CB40

Function 00007FFD9B8B1D75 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3a945bc8f8c6011316f6ac2f2fb45604b1eacf53ae5e32f542324b2f49e43c5
Instruction ID: 013435d274e6a6eafa623a239f7d8f5c05aee4a24d48c0814f97a3e63e4ba1fb
Opcode Fuzzy Hash: e3a945bc8f8c6011316f6ac2f2fb45604b1eacf53ae5e32f542324b2f49e43c5
Instruction Fuzzy Hash: E5618D22B2ED9E0FD769E77C98A45B477E1EF9920070941FBC04DC71E7DE14A9068381

Function 00007FFD9B8CEC49 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 890c15abda9da17a715baeee871a501c00dac62858c690cb28d2812399875b7c
Instruction ID: 8b360f0364ac32c2e1be0be542f450df834840af9626b213a9897c145a3a2573
Opcode Fuzzy Hash: 890c15abda9da17a715baeee871a501c00dac62858c690cb28d2812399875b7c
Instruction Fuzzy Hash: F061D371719A4C8FDBA8EB6CD899A7177E1EB5D32170501BAD08EC76B2D921FC82C341

Function 00007FFD9B8CC230 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a67a56b031ca79b9938d8c8d286bedbe1e60fb42e754d02e4089aaa5168cb13e
Instruction ID: 93add447d9b2ebc1520c93d78ef17fa8f09a7eeabbf163e71c48da4299f40a14
Opcode Fuzzy Hash: a67a56b031ca79b9938d8c8d286bedbe1e60fb42e754d02e4089aaa5168cb13e
Instruction Fuzzy Hash: E371B270719E498FDBA8EB2CC4A9B7577D1EF5D310B0545B9D04EC76A2CE24EC428B40

Function 00007FFD9B8CF155 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cbd3284f939b8dcd33d01be17a13e67b742b8c346c615a3071784d37f9bc588
Instruction ID: 24029dc8ca7fc3b39f6140197c14b724735e4d54e0edb92dc1920894005e8c92
Opcode Fuzzy Hash: 6cbd3284f939b8dcd33d01be17a13e67b742b8c346c615a3071784d37f9bc588
Instruction Fuzzy Hash: 94613561B1DA4E0BEBACAB2898655B577D1FF58300B0540BFD48AC31E7EE28FD068341

Function 00007FFD9B8B5268 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3320dd2d9825ddc93b5aafa6f551b20c934580f239d87f1328a1beb8eaf4a1f
Instruction ID: 7ca236e230becac3dc3a1a6fbff4d8a4cf7e7976c16ec892d93a72f5f6338d56
Opcode Fuzzy Hash: d3320dd2d9825ddc93b5aafa6f551b20c934580f239d87f1328a1beb8eaf4a1f
Instruction Fuzzy Hash: E0613C53B0FBEA0FE766977C58B51E43B91EF5A21430902FBD099C71E7EC04A90A8791

Function 00007FFD9B8C9AFA Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b6b47ccf53b03d0ca6dee945ac41793ab942e4757677292d383d4c1cc64d1f9
Instruction ID: a4f25eeb851a746d0ec3a4b05f5b8fde753c99a885944c13286c1a55fcc51528
Opcode Fuzzy Hash: 0b6b47ccf53b03d0ca6dee945ac41793ab942e4757677292d383d4c1cc64d1f9
Instruction Fuzzy Hash: BE613797A0F6D24FE726A7AD6C2C0B47F91EF8663470945FFC0984B0A7E81419068356

Function 00007FFD9B8B8B78 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbf9c43f0224212d2cc4879971292c9eb9aaa89083342954dc8164655aa317f6
Instruction ID: 2c12d73e55789a4a17910e8db75a9799cab95fe6254e5536fc7c425b92a18e7b
Opcode Fuzzy Hash: dbf9c43f0224212d2cc4879971292c9eb9aaa89083342954dc8164655aa317f6
Instruction Fuzzy Hash: 4D616FB1F0EA8E0FE7B5AB6898611B97BE1FF99310F0501B7D44CC31A2DD186D068781

Function 00007FFD9B8B6FF2 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ba6d2957f48e42e1c73183b3487fc614df5f77ec1d86ad7d9ba8ed81257d657
Instruction ID: 4091c3cff6deb4e4705f93ad057ecf6e91adaa97cd410be58c80a4a62df1e6db
Opcode Fuzzy Hash: 3ba6d2957f48e42e1c73183b3487fc614df5f77ec1d86ad7d9ba8ed81257d657
Instruction Fuzzy Hash: 35616B63B0FBD90EE769977C68B45A56B90FF5435470843FBC0888B0EBEC14A9468781

Function 00007FFD9B8B9146 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d20e15ea3bbfb18b0389243b99e7ceab0e46f3308dea3d16d96c0379bbc04d3
Instruction ID: a92f320db63866765d480b2ae435bd91298d773bb1e3768ad04366bb18faf0ef
Opcode Fuzzy Hash: 2d20e15ea3bbfb18b0389243b99e7ceab0e46f3308dea3d16d96c0379bbc04d3
Instruction Fuzzy Hash: 21612951F1EA5E0BEBA8A77C54791B973D2EFAC3407154579D05DC32EBED28AC024680

Function 00007FFD9B8D1E7D Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce0fa2d42aff80525c51379cdd622762f8b328162380be4f2eb8928135c01ad9
Instruction ID: 35881b7ef14bec59a65d4cb6db5ea6aa8623c0c96a67d6b454467d1820785e88
Opcode Fuzzy Hash: ce0fa2d42aff80525c51379cdd622762f8b328162380be4f2eb8928135c01ad9
Instruction Fuzzy Hash: 58714A62B0EA864FD729EB6CA8754E57B90EFA431470542FBD099C71A3FD18A906C341

Function 00007FFD9B8C4FFD Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 933d089ec7f71ffc45ef8495b01c4383484aeb7b4e843cf6abe190b4f127c543
Instruction ID: b3167d34b6d383dcedbd485fc6abf8cc1893a98cbbe40f7514b556f85e323b5d
Opcode Fuzzy Hash: 933d089ec7f71ffc45ef8495b01c4383484aeb7b4e843cf6abe190b4f127c543
Instruction Fuzzy Hash: FE51F571A0E6C94FEB76A77458361F57FE0EF4A310F0A01FBD488CB4A3D919560A8792

Function 00007FFD9B8B4148 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0b3d1294107c04c256090382ba48eca7e97a9ec84751ec6545befc91410a817
Instruction ID: bee2eddd728d8fe23ab984700adac584a72afb4a3f7d741bd27eaa6c6e98acec
Opcode Fuzzy Hash: b0b3d1294107c04c256090382ba48eca7e97a9ec84751ec6545befc91410a817
Instruction Fuzzy Hash: 7B615A71F19A498FDB58EF78D8569A8B7E1FF58304F1502BED009C7292CE34A9428780

Function 00007FFD9B8B2369 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ef87d66b047e5c13941704a6a66e000c5c0606580b12fc7f339a4e6da8ececb
Instruction ID: 24f63ae4c92c86e3d4bb58df32c5d47cf279d2af1d81f5c9db8d641d7e5b81e8
Opcode Fuzzy Hash: 5ef87d66b047e5c13941704a6a66e000c5c0606580b12fc7f339a4e6da8ececb
Instruction Fuzzy Hash: 1661F732B0EA9A0FD7A6DB6C98706657BA1FF99300B1901B6D04DC71E7DA14AC4687C1

Function 00007FFD9B8B62D5 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c93f1f96cc79fe0f82bfcdfbbe52118b3e2fbeb5fd9e3345647293a20df4f72e
Instruction ID: 637386d083085174bf8b562cd63badf224722a809f4979a664a341b3bf766b1a
Opcode Fuzzy Hash: c93f1f96cc79fe0f82bfcdfbbe52118b3e2fbeb5fd9e3345647293a20df4f72e
Instruction Fuzzy Hash: 23517EE2B0EE990FE7689B7C5865178BBD1EF6C250B0501BBD05DC31E7ED24A8428781

Function 00007FFD9B8B9599 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28f7f9be67cf6398cc728ff6e3df4a7ac0d7438a154e0c21ed5e660197be4552
Instruction ID: 227dadd8a15e83606312f061741e2394dbc264d00cb6ddb5e6d72813e82d8448
Opcode Fuzzy Hash: 28f7f9be67cf6398cc728ff6e3df4a7ac0d7438a154e0c21ed5e660197be4552
Instruction Fuzzy Hash: B6714C7161A98E4FDB88EF78C855EAAB7E1FF58300B1444ADD05AC7196DE34F846CB80

Function 00007FFD9B8B8347 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4206ba605f9f5513f51cf2d1c09e36adab2c04894d09a56870d8edfa029ad26b
Instruction ID: d1fbc77c03037f317a9d32358ee2778b2d8e09f45dfef788b3c2c6ed39c4a85d
Opcode Fuzzy Hash: 4206ba605f9f5513f51cf2d1c09e36adab2c04894d09a56870d8edfa029ad26b
Instruction Fuzzy Hash: 48513571B1AD8E4FDB98EB789865AB97792FF98300B0445BDD01EC719ADD34E8038780

Function 00007FFD9B8C4C95 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebf2955484778f1c7c10b9795df0fe48959cb92a7476a3ec71e1bd30abdd3531
Instruction ID: 502a85c426b235d1eb44e9e5ee155647bcab0d06eedf31e8b0ed861beca6f578
Opcode Fuzzy Hash: ebf2955484778f1c7c10b9795df0fe48959cb92a7476a3ec71e1bd30abdd3531
Instruction Fuzzy Hash: 85511B61B0EA8D0FEB65AB6C98655B937E1EF9931070A01BFD04DC31E3DE18AD474351

Function 00007FFD9B8C6017 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2871cad7924d6053207847e3dd5e577089ef6d8c9f82d72891bdc5b887bf4bc5
Instruction ID: bec0257f28eff12cee6c08885c137e5ff29b1e42c7502c04ddcb83b49e00b60a
Opcode Fuzzy Hash: 2871cad7924d6053207847e3dd5e577089ef6d8c9f82d72891bdc5b887bf4bc5
Instruction Fuzzy Hash: BE518161B09D4E8FEF9CEB5894A5AB973D2EFA8300B140579D01EC72D7DE29EC428741

Function 00007FFD9B8B9F85 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 449ef31641f652927e2911b1d31421d4e8a70345d1ff3f2d5be23306d6cea423
Instruction ID: 5dc0ea3188b5e0e97851adf227349c83bb3a51518eb9d805b3ed3497f44002a7
Opcode Fuzzy Hash: 449ef31641f652927e2911b1d31421d4e8a70345d1ff3f2d5be23306d6cea423
Instruction Fuzzy Hash: 3B511A2160DBCD8FD76DDB7C48659617BD1EF66220B0942FAD0A9C72E3DD24A9028782

Function 00007FFD9B8BD275 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 881048058a9f1ef753572a9b3a8d3c2d83d7d096e4a7cd73ab61f0267462c0b0
Instruction ID: 7a43353c9e87d63c3087db9d6a2a203cd39ef0cceed01dc5b922a3caa51dbb5b
Opcode Fuzzy Hash: 881048058a9f1ef753572a9b3a8d3c2d83d7d096e4a7cd73ab61f0267462c0b0
Instruction Fuzzy Hash: 20512B22F1EE8E1FFB68A77858655B87BA1EF58340B0501FBD00DC31A7ED28B9464781

Function 00007FFD9B8C6159 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1b3132e640654bc2bf992f835ffaed0f24e592615f862acbff5c1f928d16786
Instruction ID: 57a2400aa2f7904c041c88ad5b7a204a739ddececd60a9290a5e896934a7b12b
Opcode Fuzzy Hash: c1b3132e640654bc2bf992f835ffaed0f24e592615f862acbff5c1f928d16786
Instruction Fuzzy Hash: 0E617F74608A4D8FDF98EF58C8A4EB973E2FFA8304B104569D41EC72A5DA35EC42CB40

Function 00007FFD9B8CE5E0 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b01218a7a54a2a951afd411e8d6094e188b600203a3e68dcbe0cc64a80540010
Instruction ID: c2e78e2e758684203ca4885af7bbb79bf0cbe728ffeaf3d6492cf253f24829ee
Opcode Fuzzy Hash: b01218a7a54a2a951afd411e8d6094e188b600203a3e68dcbe0cc64a80540010
Instruction Fuzzy Hash: 3551C4B1B19A4E8FDBA8EF5888749753391FF5C314B2102AAD41EC76E6DE25F842C740

Function 00007FFD9B8D80ED Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5714f9f382c7a921670c51066f5793647d5382b45bf01bdfc875ff1c94fe7c21
Instruction ID: c76f28a996b5047936d9a2156c6fcae3964200eedff09ae0e7ae4f231fd03aac
Opcode Fuzzy Hash: 5714f9f382c7a921670c51066f5793647d5382b45bf01bdfc875ff1c94fe7c21
Instruction Fuzzy Hash: F1515971E0EA4D4FEB68AB6C98299B977E1EF99310F0503BBC44DC71A2DD286D478341

Function 00007FFD9B8B93C2 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 672b25d1f165b776d84e1b09373b351d8cfdfa2ccf8cd2149ecde1f2517a02a9
Instruction ID: 7b240ed87c41c11295a7ef082e4656e3937950e82490b162e7c882e1f9c2dd7b
Opcode Fuzzy Hash: 672b25d1f165b776d84e1b09373b351d8cfdfa2ccf8cd2149ecde1f2517a02a9
Instruction Fuzzy Hash: F851C16170994E4FDB88EF68C865A69B7D2FF9830471444ACD05EC72DBDE29E846CB80

Function 00007FFD9B8C31B9 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83c1d97212e4bd47d155180eeb9d58f27610a15b163b1e45b767d82cb67f69ef
Instruction ID: f09bb4bd45266fec6399c426508c45b4f5b2bf3e4d9804cb415c47afce43703f
Opcode Fuzzy Hash: 83c1d97212e4bd47d155180eeb9d58f27610a15b163b1e45b767d82cb67f69ef
Instruction Fuzzy Hash: 0B515771A0D68D0FE775AB7458265F97BE0EF8A311F0502BBD48DC31A2DD39660B8782

Function 00007FFD9B8CD06A Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97d74acc2cbb83c0e491605a3f641c618c362fb668bb2fac70109a2e03291025
Instruction ID: f051d8eeb702917572f1716563f6ad334ff60810d8e5bf961c7ad039ee822261
Opcode Fuzzy Hash: 97d74acc2cbb83c0e491605a3f641c618c362fb668bb2fac70109a2e03291025
Instruction Fuzzy Hash: D5411771B0E68D1FE368BB6C5866475BBE1EF4A21070541BBE489C71A3D919AC078382

Function 00007FFD9B8B090D Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a892b33485c534fa121a68200701ace76a67138574a0a7aa5a1c6b76357954f
Instruction ID: e5b3b9a58975f2776c088d4aa8e4384e50be3f39ef563fe7dc3a54359bc70853
Opcode Fuzzy Hash: 1a892b33485c534fa121a68200701ace76a67138574a0a7aa5a1c6b76357954f
Instruction Fuzzy Hash: 65514A32B1EB590FE758DB7898655B877D1EF99610B0401BFE04DC31A3DD246D068BC1

Function 00007FFD9B8B3491 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1e31550c1ec2d91de8b3bcb41f006e0be841ae8888321f358132523a89b90d5
Instruction ID: 5d4d807cdaf44e7591302b74340b7c56c4dfb90388652dd85e8193bd1fb814b9
Opcode Fuzzy Hash: f1e31550c1ec2d91de8b3bcb41f006e0be841ae8888321f358132523a89b90d5
Instruction Fuzzy Hash: 7651D430B1DA5D4BD7A8EB6C9860A79B3D2EF99300F05057EE04DC32E6DD29E9418782

Function 00007FFD9B8C41D9 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd3d0c9716aa0a87846786252961fa00ec1079f12735817158bc9dcabbce8adc
Instruction ID: 636d7483e21a3a88b7ab7d286e80e3e282818f2c7d939def5186d690f397c03c
Opcode Fuzzy Hash: fd3d0c9716aa0a87846786252961fa00ec1079f12735817158bc9dcabbce8adc
Instruction Fuzzy Hash: 6051D770A09B4E8FDF99EF68C495AA57BF1FF99300B15416FD419C7295CA34E882CB80

Function 00007FFD9B8C065A Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 282e43c91aba68aabb23af2f157fbd4a108519bb6980fbf90a20d456d1379f6c
Instruction ID: f79d30148b0ace67b02c4160cbe4c455a75a5ab6077951372c56899bf91a247f
Opcode Fuzzy Hash: 282e43c91aba68aabb23af2f157fbd4a108519bb6980fbf90a20d456d1379f6c
Instruction Fuzzy Hash: 7B517A61B2DA8E4FE758EB6C88646757BD1EF98780B1441BBD09DC31E7DE24AC068341

Function 00007FFD9B8CAD60 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d47628817e6b100303904b6fff401cbf5af0b1b47203cba15e3debb7b5ba6d1
Instruction ID: b182a7fac73d24fa76df3ed8ebf31a94fe80c1d82595608d302deb8cbf62d40b
Opcode Fuzzy Hash: 6d47628817e6b100303904b6fff401cbf5af0b1b47203cba15e3debb7b5ba6d1
Instruction Fuzzy Hash: E251F871B19E4E5FEBA8EB6C98656B677D1EF98340B4400BAD45CC719AEE34ED018380

Function 00007FFD9B8B960E Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be12e83188e6f67174de3c7385669acddf5975ea0e24fc795fc8322fc7a77653
Instruction ID: 324216843b9a8da9f3e0a255f1ebc2bf6e7f515e01c488b94ccaf19e9fda4d3e
Opcode Fuzzy Hash: be12e83188e6f67174de3c7385669acddf5975ea0e24fc795fc8322fc7a77653
Instruction Fuzzy Hash: 26513BB161AA8A4FDB88EF78C859E65BBE1FF5830071444EDD05EC72D6DA34E806C741

Function 00007FFD9B8D8833 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93d9aee8878869cb6ea6863351e1a3dc3aa8b64d08441cd142dbc16b6a39675b
Instruction ID: 41b5a5da08eb8d69b5d2e3d923eb2a3dcd1ee47450cf109573b208c574d17428
Opcode Fuzzy Hash: 93d9aee8878869cb6ea6863351e1a3dc3aa8b64d08441cd142dbc16b6a39675b
Instruction Fuzzy Hash: 63511812B0F6C90FE7669B7C5C255797BA0EF96300B0A42FBD098870E7CE559A078382

Function 00007FFD9B8B7E6D Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b10fa318f073a583c51e4ad55e18cebcd27739153a8712aa0e46300703e0dd61
Instruction ID: 9755a6e7627a13d20ae87eecd97970ba4b2f9ebba94484c054f51654aec9dcd3
Opcode Fuzzy Hash: b10fa318f073a583c51e4ad55e18cebcd27739153a8712aa0e46300703e0dd61
Instruction Fuzzy Hash: E0418431B1CA194FE758BB6CA866ABD77D2FF98310F1001BAE01DC32D7ED246C424682

Function 00007FFD9B8C5B00 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1ff177512db1118d423745ef16cabc8cced04a6db1259136fb05de4c5553ab1
Instruction ID: 7e869dfc6b6d5b6417c95f9cd37a39bd9aea4b54db1e87b245e129f9237503eb
Opcode Fuzzy Hash: a1ff177512db1118d423745ef16cabc8cced04a6db1259136fb05de4c5553ab1
Instruction Fuzzy Hash: F051A27060894E8FDF98EF58C8A5AA977A2FF68304F144169D01AC72D6DB35EC42CB40

Function 00007FFD9B8C8289 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975f9839881904f9bdf81093c0f01cff8ed10579b163131e3f967ceea000c58f
Instruction ID: 7ac6b993d70581f22e9edffa4ce76a304d944041555e68b84b8cc550f33077d7
Opcode Fuzzy Hash: 975f9839881904f9bdf81093c0f01cff8ed10579b163131e3f967ceea000c58f
Instruction Fuzzy Hash: F051E770649A4E8FDB98EF68C8649F677E1FF58300B1545AEE41DC72A6CE35E842C740

Function 00007FFD9B8B4BA8 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe771b835d5e0b5be8ea8988c768aac03709e35b7c9e59fb0cde5aabba9a0e5a
Instruction ID: f8d248a88c4df7c38cd989b9d7898981e228ede4bbe7dfed5781e1805b452424
Opcode Fuzzy Hash: fe771b835d5e0b5be8ea8988c768aac03709e35b7c9e59fb0cde5aabba9a0e5a
Instruction Fuzzy Hash: C1415612B0FAEA0FE76AA77C2C755A86B91EF9525870902FBD099C70E7DC1819074381

Function 00007FFD9B8C38A5 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f42d78086c990de9f80ca54b022905477e1e88e017b84b9e938f476c16c566e
Instruction ID: a7c70df59646a0bbd46c4bd2c5e0ad280d3f7ffbd8a99e026ed0d65689e5d50e
Opcode Fuzzy Hash: 5f42d78086c990de9f80ca54b022905477e1e88e017b84b9e938f476c16c566e
Instruction Fuzzy Hash: 2A4127A271EE8A0FEB6CA62C586667537D1EB9E35430501BFD04DC72E7ED14AD0B8381

Function 00007FFD9B8C5C40 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e9b7963d790996f4c151a89d5c78965886fb92e0fccce280a5f29718e98c3cd
Instruction ID: 2735f2c42f4ffcc42747e8e873a38fbf2095f0a06679464f3c28583a268e51a5
Opcode Fuzzy Hash: 8e9b7963d790996f4c151a89d5c78965886fb92e0fccce280a5f29718e98c3cd
Instruction Fuzzy Hash: 6C517071619A4D8FDF98EF58C8A5AA573E1FF68300B1442A9D41EC72E6DA34EC42CB40

Function 00007FFD9B8C3E42 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05f6cf743648ae25f9a3947e1b696608620f68e24471406320512e4c1df4b50e
Instruction ID: 904057a0e46491b87ed759e31188e743854171dfd15d428d8623d20a10a1a306
Opcode Fuzzy Hash: 05f6cf743648ae25f9a3947e1b696608620f68e24471406320512e4c1df4b50e
Instruction Fuzzy Hash: 9C412D62B1E7994FE72A67686C7A4F97FE0DF46724B0941BBD089C70E3DD2428474342

Function 00007FFD9B8C8149 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a7d124a46ca44eb0b57497c2d6371b5d157138a5f07bf279b7b721fda04a6e0
Instruction ID: 5790b3c1c14ae4483e27beea87e62301bfe02761babad7b7fbba2f26afc1d58f
Opcode Fuzzy Hash: 7a7d124a46ca44eb0b57497c2d6371b5d157138a5f07bf279b7b721fda04a6e0
Instruction Fuzzy Hash: 96413972A4EA9E0FE775AB6048255F57BE0EF49310F0601BBD45CC70E2D9185A1B4782

Function 00007FFD9B8B4388 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b27c0aeb9736f851d514f7fd1873f09e0abc604368a1ee3e2a897e236669fc89
Instruction ID: 858165c05e56ceeb098b57d4a5e6e2e8cc737ee44d7dca723a9040ebd422f7da
Opcode Fuzzy Hash: b27c0aeb9736f851d514f7fd1873f09e0abc604368a1ee3e2a897e236669fc89
Instruction Fuzzy Hash: 3E41F771F1895D8FEB58EF68D45A6A8B3E1FF68304F15017EE40DC3295DE34A9428B81

Function 00007FFD9B8F4C43 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e6ccdfdba1bb9d66417ff1994235bc7e237a5ca96eb9ca3dbc1287a85c5381a
Instruction ID: c5f4f12ba0f2f9bb8bf4bb8a8d4ab45bcdb699c1977d8087bb649d14f1de9d4d
Opcode Fuzzy Hash: 0e6ccdfdba1bb9d66417ff1994235bc7e237a5ca96eb9ca3dbc1287a85c5381a
Instruction Fuzzy Hash: 42412D21A0E6D80FE766976948610643FD1EF96204B2D00FFE4D9CB193D91ADE07C3D2

Function 00007FFD9B8B6D88 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57408e9fce06acb21bb1ae5a4b3604d30bfb3644bc2f511304005f6f7b16e5d7
Instruction ID: 13c5efb4d1903c523100ab1659a4e74c839e71bcb2ca6f266592c7637b8ff300
Opcode Fuzzy Hash: 57408e9fce06acb21bb1ae5a4b3604d30bfb3644bc2f511304005f6f7b16e5d7
Instruction Fuzzy Hash: 0A41E731B19E0E4FDBA9EB7CA860675B3D2FF98354755067AD00DC3299EE25F8428780

Function 00007FFD9B8D0548 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9a4c6d71e55ff1fa8f7adec2378a9f62198e43b20c77f3dc8d13e1942cd6cff
Instruction ID: 5add23084ca822ff0a0f16644d5b105d5602e3d8b58bc46e64b33cda3ca7ced3
Opcode Fuzzy Hash: e9a4c6d71e55ff1fa8f7adec2378a9f62198e43b20c77f3dc8d13e1942cd6cff
Instruction Fuzzy Hash: 0A415B72B1EA8D4FE7A99B68A8701B43790EFDA710B0603FBD409C71E2DE15AD01C781

Function 00007FFD9B8CC1B9 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cb457f8eaea4d93a1c23323272a3fc12a9f325dfcff6d0e2603b2829c12bd81
Instruction ID: 4319f27a1f5dc781a663f5b574f12ed622da3b6877be23024450bdece5808afe
Opcode Fuzzy Hash: 8cb457f8eaea4d93a1c23323272a3fc12a9f325dfcff6d0e2603b2829c12bd81
Instruction Fuzzy Hash: 5641DB7270DA494FD7A4EB6CD899A7177D0FF5933170502BBD08AC75A2DA25F882C740

Function 00007FFD9B8C95F4 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ee5d25f26eccc83821673395196040798d36c516f037b4f3fda9f699c74ea7f
Instruction ID: 6bc7eef99edbc87cfe234fee0874af9a10c1ecb524d9ed5f2c699e5685cbad70
Opcode Fuzzy Hash: 8ee5d25f26eccc83821673395196040798d36c516f037b4f3fda9f699c74ea7f
Instruction Fuzzy Hash: 69411C6260FACE0FE793A7B858695A53FE1DF9B260B0A01FBD48CC71A3D9095906C311

Function 00007FFD9B8D1090 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2adcd9b4044f08c255c74cba8aa6d09f5eb94009435439a6829d41de23b66cb2
Instruction ID: bde33247c09ac5c75d95e0cb39e90ed6c210b58f47f2c0bebc77c9934057446a
Opcode Fuzzy Hash: 2adcd9b4044f08c255c74cba8aa6d09f5eb94009435439a6829d41de23b66cb2
Instruction Fuzzy Hash: B9412421B0EA990FE3AEA77C58651B57BE1DF9A250B0503FFD04EC71E3ED1869468380

Function 00007FFD9B8B6939 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d11290592d8ed194968d7915f0719798dd026f920ea657ae89e958aabbf4855
Instruction ID: 0a461e028dff26982ea748704b08622dd79f6bb68d0a5ff12901165683ac5845
Opcode Fuzzy Hash: 4d11290592d8ed194968d7915f0719798dd026f920ea657ae89e958aabbf4855
Instruction Fuzzy Hash: 8A415A51B0EA9A4FD759A7BC5C35A74B7D1EF68200B0542FBE05DC72D7DD18A8414381

Function 00007FFD9B8CD0E0 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4acb7b631055c27f254278f9423a8071ad483a0a1ca440ff2908c8e709c3d4a0
Instruction ID: aacc7359f8ca681f4ff3a11bad802c58acbd30281858e5d835b2eecb372c7af5
Opcode Fuzzy Hash: 4acb7b631055c27f254278f9423a8071ad483a0a1ca440ff2908c8e709c3d4a0
Instruction Fuzzy Hash: 9F310272B1CA0D5FE768FA5C9856975B3C5EB89320701817BE48EC32A6ED25FC038781

Function 00007FFD9B8CDB89 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10dd0591aac438e5b1d8d04ec99534aa19cc940210ca9375e405542686691942
Instruction ID: 097d78aef66c69b22f8e0a534c3123b55fba09565271bdd88dc0337e6e9f33b2
Opcode Fuzzy Hash: 10dd0591aac438e5b1d8d04ec99534aa19cc940210ca9375e405542686691942
Instruction Fuzzy Hash: 45316D62A0F7C90FE752A7784C754A07FB1EE5B66130E81EBC088CB0F3D509594B8352

Function 00007FFD9B8CB2FA Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9efec3fd5392de38078632e078edcd53dbd3be3487d1e7d95afb66f1254970bb
Instruction ID: 141e3dcbad890af3ce0aeb978cefc448d79eff42b7f8dfe6050f075d400580ed
Opcode Fuzzy Hash: 9efec3fd5392de38078632e078edcd53dbd3be3487d1e7d95afb66f1254970bb
Instruction Fuzzy Hash: FE414D3170DB494FE755EB2CE8A46A177E0EF99314B0441BBD049CB2A3DA25E887C780

Function 00007FFD9B8C83FD Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b12cc865d54bf16a7f51972f84992c97bddbd3f72368e5f23c3881aafd28ce35
Instruction ID: 1c4cbc3cb4f225275954fe017b517105a62b61653b125612e84d1e3083a435f4
Opcode Fuzzy Hash: b12cc865d54bf16a7f51972f84992c97bddbd3f72368e5f23c3881aafd28ce35
Instruction Fuzzy Hash: 06415074718A4E8FDB98EF18C494AB973E2FF9C340B544569D41AC72A6DB35EC82CB40

Function 00007FFD9B8B2818 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 808888efb87a82886ff8f6e4ee25fb02120837fa867f8d7c42b175015b904ee4
Instruction ID: bf2dd317e82b45cba8d9bfd723ae02b1d08ba53b46675025e43bdbc951be1b79
Opcode Fuzzy Hash: 808888efb87a82886ff8f6e4ee25fb02120837fa867f8d7c42b175015b904ee4
Instruction Fuzzy Hash: AC314631B1DA1D0AE73D9EA9BC914B577D1EB88720B11027DD49F831E7ED28B89386C1

Function 00007FFD9B8C9635 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dc523f1a7cdf7267e96dc7cf3948af0e8dc2cb929422fa55d5119de1d738cac
Instruction ID: 73565727d9700980ca479d34683bd1313250e393368043b8b67e680ea578dac0
Opcode Fuzzy Hash: 8dc523f1a7cdf7267e96dc7cf3948af0e8dc2cb929422fa55d5119de1d738cac
Instruction Fuzzy Hash: 5631F85264FBCA1FD79357B858685A13FE5DF9B160B1A01FBD488CB0A3D909490AC351

Function 00007FFD9B8B44B5 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e6d188a9e07229f345c9f1b95a2c245ccf64ab8218f4b75898e107f6e02a324
Instruction ID: df916f77cf8a9c7f393681914cab12ec7d0a1e13a95d5af38971905d85d435ab
Opcode Fuzzy Hash: 7e6d188a9e07229f345c9f1b95a2c245ccf64ab8218f4b75898e107f6e02a324
Instruction Fuzzy Hash: 0931E722A0FADE0FD7569BB48C714A97FB1EF5A340B0902FBC058CB1E3DD1859468791

Function 00007FFD9B8D1C18 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dae5920589e1c45511977ce6ea7e5b75f8fb5bb2d9af8e2f0953521e9a315a9
Instruction ID: 217ad23b9f2c8559046431f61a3ca257d035c9d36109b593274c88137ca2f0a1
Opcode Fuzzy Hash: 4dae5920589e1c45511977ce6ea7e5b75f8fb5bb2d9af8e2f0953521e9a315a9
Instruction Fuzzy Hash: 8441D430A0DA4D4FD768DB5884556A6BBE0EF99320F0503BFE05DC31E6CB74A98583C1

Function 00007FFD9B8CAF0D Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72071c8a5ded258d3678df112324f5efe6d87a0115878d9e9d4190eccb0c8f22
Instruction ID: 9faeb166a9c7b134fabdbfb733e26928d34907899763b598526a4afbecdb7422
Opcode Fuzzy Hash: 72071c8a5ded258d3678df112324f5efe6d87a0115878d9e9d4190eccb0c8f22
Instruction Fuzzy Hash: BF313CB1B1EB4C5FDBA5AB6898A45A53BF1EF5A700B0601AFD449C71A3DA30AC05C741

Function 00007FFD9B8D82ED Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13614e92ee23e38b7b3d00add4db098d7fc3739e0639e2dfadc545bec0b565fa
Instruction ID: d8d6aa9d988b5d0d384821d229a243f9bc5fea901e973397d6be2c72abb320f7
Opcode Fuzzy Hash: 13614e92ee23e38b7b3d00add4db098d7fc3739e0639e2dfadc545bec0b565fa
Instruction Fuzzy Hash: C8312661A0FBC90FE76A977808251993F90EF9A250B0903FBD089C71F3DC582807C351

Function 00007FFD9B8B97C5 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ec0fa25e95e0af8a4a8016334a588c73b08a4e1987c1e875f32cdb1bb258e8
Instruction ID: ba0beb35422d8f0a5b9ce17d247f76ca07b543d1c830398a0fa07712de59ba75
Opcode Fuzzy Hash: e0ec0fa25e95e0af8a4a8016334a588c73b08a4e1987c1e875f32cdb1bb258e8
Instruction Fuzzy Hash: 0E318724B1991E4FDB99EFA8E465AB97391FF49300F105579E01AD72DBCE38E8018B80

Function 00007FFD9B8D10D0 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d30ba4abbbda38662b7d0aa115239da32a3713d3bf4116af9a485abdb621f174
Instruction ID: 89a5ae91dfa0b94f9f13ca4ff42b75c4b93b29e5fc71b5e29f82b84e3992d5ef
Opcode Fuzzy Hash: d30ba4abbbda38662b7d0aa115239da32a3713d3bf4116af9a485abdb621f174
Instruction Fuzzy Hash: FF31EB62B1DE8A4BDB6CEB6C94259B5A3D1EFE8350B0047BBD05FC31DAED2468068341

Function 00007FFD9B8BDDE0 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a1b17ece1acceaf47d138bf76028fd98c28ffadcc5f4917f5df1358ae4759d0
Instruction ID: 9bd6ea57635642c54f8d5652265b0be3a85eb6df09f5a4840ccd48a1530b1b3e
Opcode Fuzzy Hash: 4a1b17ece1acceaf47d138bf76028fd98c28ffadcc5f4917f5df1358ae4759d0
Instruction Fuzzy Hash: 0E410B20A1D9A98FFB55A7B858617F977D1EF19300F1500AFD098C71D2D928ADC1C792

Function 00007FFD9B8BC6CC Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b62313d3fbd2787d06e32dcf52c33b7fef23f902820f4147f00dae54e4ecc3a
Instruction ID: dc7ca59b8bd83516644791ea3ef957e7a98d67e822b62ba221195e5cdfff49a7
Opcode Fuzzy Hash: 1b62313d3fbd2787d06e32dcf52c33b7fef23f902820f4147f00dae54e4ecc3a
Instruction Fuzzy Hash: EE310A30A09A8E8FDF99EF68C8545EA77F1FF59300B10416AD419D32A5DB34E942CB81

Function 00007FFD9B8CFE30 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 913f4f51c514692ee2c0c89e406a0a76033d1ade2a32342d9c6ea600d998e753
Instruction ID: 6621ba215dd9bb4a3e2bcf57a378c8a01a4aa8b0ee22c5dc9f6570b6b790f527
Opcode Fuzzy Hash: 913f4f51c514692ee2c0c89e406a0a76033d1ade2a32342d9c6ea600d998e753
Instruction Fuzzy Hash: D221E471B19D4D4FE7E8E76C94A967837D1EF6C211B0501F7E04DC72A2DE15AC468380

Function 00007FFD9B8B0825 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7644848ac1442b175596e384a5e418644d03182ea41c7db3903bd2703e46e3d1
Instruction ID: 99b0ebb221192094041b222df333193104a0a817af502ebfe6c35339c160a724
Opcode Fuzzy Hash: 7644848ac1442b175596e384a5e418644d03182ea41c7db3903bd2703e46e3d1
Instruction Fuzzy Hash: 26312B32B1EB9C0FD75197AD6C111A83BA0FF89761B0542B7D49CC71A3D9159E058BC2

Function 00007FFD9B8BF32A Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 375cf238c950714aaca2e01ca5ca6db9cd5f216507c6e577f99cee6820b3d37f
Instruction ID: 3d5935d7c93202e9a2876d1e0d9f674f85c0804a02a5f73cbdc0ee9768080559
Opcode Fuzzy Hash: 375cf238c950714aaca2e01ca5ca6db9cd5f216507c6e577f99cee6820b3d37f
Instruction Fuzzy Hash: F831C821B19D5E4FEBA4EB7C84A56B973D1EFAC304B1541B5D40DC32FAED24AD028B81

Function 00007FFD9B8BC6F9 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea6437aa0e6ce2c1e68f4237df68b1eb85ca1d0faf77a57c1f6c828b3c8688c1
Instruction ID: dd069dda2d917b6a3878af486f6204a176b026e05d3608280f1f76977af4d2c4
Opcode Fuzzy Hash: ea6437aa0e6ce2c1e68f4237df68b1eb85ca1d0faf77a57c1f6c828b3c8688c1
Instruction Fuzzy Hash: 69315C30609A8E8FDF89DF68C8A45EA37F1FF5D300B14416AD419D32A5DA38E842CB80

Function 00007FFD9B8B8E20 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 195492b99d31943d875fdc1a4644f06c9c8dd67b1b52bfac1ec5ea9722869c2e
Instruction ID: 3593c0ca0d13b81fbed1a58ec3213e73866101a1a8ff6509b9b38cb1a44371f1
Opcode Fuzzy Hash: 195492b99d31943d875fdc1a4644f06c9c8dd67b1b52bfac1ec5ea9722869c2e
Instruction Fuzzy Hash: D9315932B0ED5E1FE7A8933C482526937E2FFCC350B4542BBE04CC31A6DE2899060381

Function 00007FFD9B8D3EA8 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6de74dc4beebee13fe8f4499f90af9fc6cdf70ee7b40a0879ae162fc7a076d
Instruction ID: ace6167536c3780f42d9bc3991cb2fe66ba778645b16c8792d67ca947366f856
Opcode Fuzzy Hash: 1d6de74dc4beebee13fe8f4499f90af9fc6cdf70ee7b40a0879ae162fc7a076d
Instruction Fuzzy Hash: 6331D631A0D7894FD769DB6C84546A67FF0EF9A320F0507BFD089C71A6CA34A846C781

Function 00007FFD9B8B6970 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaa339406079f55dce0353b0c8f519fb4332623420d711f4b33df2db4163d28d
Instruction ID: 16020f487073f6af70f4b30dfae5d7c14499a7d5b7b85c15db55fb5e936d8dbc
Opcode Fuzzy Hash: eaa339406079f55dce0353b0c8f519fb4332623420d711f4b33df2db4163d28d
Instruction Fuzzy Hash: 6731FB51B19E5A4BEB5CF77C6C65AB5B3C1EFA8250B5142BAE01DC32DBEC14B8414381

Function 00007FFD9B8D575C Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07e1e1b87ffd293b6e463ee3f454db9039bc222733adf207a7464abbada7bd26
Instruction ID: 5896307e0a38e41dd8057d5a81643f16e1e99a5073742fd427ef1d12308d2e33
Opcode Fuzzy Hash: 07e1e1b87ffd293b6e463ee3f454db9039bc222733adf207a7464abbada7bd26
Instruction Fuzzy Hash: F931B4B1A5DB098FE32C9F6D90520B6B7E1FB89A20710152FC1C783E62D632B8038745

Function 00007FFD9B8B8870 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2313f79e39f3490aa2ae6fa3677abd407e5df2a1e03c5d34393e52689f04e6a0
Instruction ID: 49d396392f0bfce58541fc7b4d106b5869f145e266b9386c1c3450cfbc62a215
Opcode Fuzzy Hash: 2313f79e39f3490aa2ae6fa3677abd407e5df2a1e03c5d34393e52689f04e6a0
Instruction Fuzzy Hash: 4631FB21A0D6D90EE75AA76944610643FD1DF9B204B7901FFE4D9CA193D81ADF07C3D2

Function 00007FFD9B8C6F41 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e1be1bdc34833b6c34c53405ba444e4e01f5de131bc2f26da80762a21064081
Instruction ID: ae47ad8038a932a4c4aedc9b2c49877edca60a6a5ef12e9d139cedf999545395
Opcode Fuzzy Hash: 6e1be1bdc34833b6c34c53405ba444e4e01f5de131bc2f26da80762a21064081
Instruction Fuzzy Hash: 1131F4A6F0A94E0AFBF1BBA848612B977D0EF6C311F0A0177D41CC35A2DE186E094781

Function 00007FFD9B8BE639 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18872a50f8762eb213acad0eeb8378b09ae068e46baead86de2455c69834c24a
Instruction ID: 17b16736a9087cb95f69bb46b1d7ecbf9584acdc56d1b7107f2bdf311d576382
Opcode Fuzzy Hash: 18872a50f8762eb213acad0eeb8378b09ae068e46baead86de2455c69834c24a
Instruction Fuzzy Hash: D731B571B1985E4FDB9CEB18D465EA9B7A1FF58310F0046BAD15EC3296DE34A842CB80

Function 00007FFD9B8B857E Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18bf02f85805cde7d3ddf2933c59950c5daee434afabcb3a5ea763ef9fea2c78
Instruction ID: 7e75694a1ebeed837c57486c12bb0212b8f38c75b5043fa7dff0693361e69bf2
Opcode Fuzzy Hash: 18bf02f85805cde7d3ddf2933c59950c5daee434afabcb3a5ea763ef9fea2c78
Instruction Fuzzy Hash: 1731D91190E6DE0EE7B253B488395E53FE1DF8B220F4A01FAD45CC74A3D91D190B8792

Function 00007FFD9B8B6838 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a739cf407a5b49e064db596490c0759937220bbed233b9d2a97317e4267bdb00
Instruction ID: a0ba2d2f1e206d2544600c52f5e537b8d816b8b0f3468f3f64b06b5e9d6f6290
Opcode Fuzzy Hash: a739cf407a5b49e064db596490c0759937220bbed233b9d2a97317e4267bdb00
Instruction Fuzzy Hash: 2331A7A190E3D94FEB5287B898715A8BFB1AF5A310F0A41F7D0889B0F3DA146906C791

Function 00007FFD9B8BAB40 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 575585cc938867469d9d48a0b457b81da7b8eda1170b698c63f552138a445791
Instruction ID: df133dd2934abf85be4663615638e28c8e44129ea45e6bd5fc8a9dc3ed506bec
Opcode Fuzzy Hash: 575585cc938867469d9d48a0b457b81da7b8eda1170b698c63f552138a445791
Instruction Fuzzy Hash: 10316931B0EA8D4FEB59A7B858745A83BA1EF59350B1501F6D02DC72E7DD389842C781

Function 00007FFD9B8B8D3A Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eed132411434457a83bb73e4c922ed3aedd28d28432c8cd71bdde8b1876d40fc
Instruction ID: 2130cbc23af57f8d96c0a53ea7e5bec286cfe14fec3a1b9f5bfcc05fb2696eb4
Opcode Fuzzy Hash: eed132411434457a83bb73e4c922ed3aedd28d28432c8cd71bdde8b1876d40fc
Instruction Fuzzy Hash: 02218F67A1E96B1FD70A6739A8721D47F60EF16268B0D02B7C4D84B093FD08358B47D1

Function 00007FFD9B8B62A8 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18b56836efae7168501c06f3ca70b3d923276e119778bbff67078a4663982f16
Instruction ID: 162012d764d38f55092fb9c9c44d9dea097198342b7d52ba4c1d5c6ccb84bffd
Opcode Fuzzy Hash: 18b56836efae7168501c06f3ca70b3d923276e119778bbff67078a4663982f16
Instruction Fuzzy Hash: 1B214D62B1AE5E0BEBADDB2854A497567D1EF6C34070442FAD40DC32DBED24A9418BD0

Function 00007FFD9B8C40D6 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fb3425a6408875bc7c9613885ed3b30e7fda18a6dd8a9428bc8f51d814191a7
Instruction ID: 104807ec6f14f8d81b51c34adae00a74237fd84bf41d1d17b6fc81350a0b70be
Opcode Fuzzy Hash: 1fb3425a6408875bc7c9613885ed3b30e7fda18a6dd8a9428bc8f51d814191a7
Instruction Fuzzy Hash: 8C212DA1F0E94E0AF7B4F7A818662F577D0EF6C310F0A117BC49CC3592DD186A494781

Function 00007FFD9B8BC7FA Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b26088fbf6035dced66157447c8c012dbfa6c32613b472baa5b1e9bc899dfd1b
Instruction ID: 6e812126dfdcc9c06551581af5cb386857e017dc3b8dc28f122379b944563b29
Opcode Fuzzy Hash: b26088fbf6035dced66157447c8c012dbfa6c32613b472baa5b1e9bc899dfd1b
Instruction Fuzzy Hash: F7312A30614B4D8FDB88EF18C895AAA77E2FF9C304F10056DD45AD72A5CA35E842CB81

Function 00007FFD9B8D83DA Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65de6893d8ca2cd1c0ae10b1f2c1333684603d39648abef21fb3d7723fc25edd
Instruction ID: 018ef08bef22e910a3bb789d213789f874f584cdaed13c0191af97ac844c5448
Opcode Fuzzy Hash: 65de6893d8ca2cd1c0ae10b1f2c1333684603d39648abef21fb3d7723fc25edd
Instruction Fuzzy Hash: 1E214F31B0991D4FDB98EB9894617ECB7E2EF9C310F51127AE10DE32D6CE65AD428780

Function 00007FFD9B8C91A8 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f70bc83c06fd7341c71167ac56d5ee81487dda6cd49c2d5db79ae3645d03dc66
Instruction ID: 591a369f8ef1b421975ea5879cc0f493ca734870ec6f5fb72f1984c0bc17ee5f
Opcode Fuzzy Hash: f70bc83c06fd7341c71167ac56d5ee81487dda6cd49c2d5db79ae3645d03dc66
Instruction Fuzzy Hash: 3A11063171D90C0FA36CE65DAC5A9B573C5EB9922130503BFF09EC3AA2ED10AC4242C1

Function 00007FFD9B8CC50E Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e81817781d562aa5a48344737a18ee703e8c2f1b5c075a8ffa56dd0371191843
Instruction ID: bede50c8dc117ed451faf4f0c03d7d6a17c37401459cd13052c618044b5c1346
Opcode Fuzzy Hash: e81817781d562aa5a48344737a18ee703e8c2f1b5c075a8ffa56dd0371191843
Instruction Fuzzy Hash: 0B217771B09C0D4FEBA8E74CD469AB973D2FB9C35070141B7E45AC72A6ED15ED424780

Function 00007FFD9B8CFF85 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb047d28e11b35cff61a866170adcd8668a7b1a1c6344571f10beb8fc61e6e80
Instruction ID: 279c1ce413217323b4528ff2d2a67c80e343d8ac15f2fcf1420ee6d23258e5fc
Opcode Fuzzy Hash: bb047d28e11b35cff61a866170adcd8668a7b1a1c6344571f10beb8fc61e6e80
Instruction Fuzzy Hash: 6421D860B1EA8C0FE7A5E7688874AB43BF0EF5A700B0541E7D089C71E3DE1CAD468341

Function 00007FFD9B8CF839 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dcad32622394adc65355dde34f4cbdbe4a401ff3f53a667a4fec39ef255e67e
Instruction ID: 948d2badab01116c810a38385eb4efc2c400e82583ecb50545316f543cd43b59
Opcode Fuzzy Hash: 6dcad32622394adc65355dde34f4cbdbe4a401ff3f53a667a4fec39ef255e67e
Instruction Fuzzy Hash: 88213961A0F7D55FE356A7B448399A47FB0EF1760030E45EFC085CB0B3DA0C194A8352

Function 00007FFD9B8B77CE Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 979adbf12b35df250b0e8546ff7a8d5688f18354ee25da14c649e8db84462a7b
Instruction ID: 0ba8045e69009a69ef9801f148865bbc6014387fda032d5e6d388730532536f0
Opcode Fuzzy Hash: 979adbf12b35df250b0e8546ff7a8d5688f18354ee25da14c649e8db84462a7b
Instruction Fuzzy Hash: 4721B821B19F8E4FDBA9E7385874575B7E2FF9931470506B6D059C3196ED24E802C780

Function 00007FFD9B8C55A0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c13919ec6313aa82e0bcb3eac138333bca2fa0a6fd49024159f710735085c3
Instruction ID: 0721d6cbecad2ed1c1d62b36b322373bb919cd621e69252e16fd074ba1739135
Opcode Fuzzy Hash: 14c13919ec6313aa82e0bcb3eac138333bca2fa0a6fd49024159f710735085c3
Instruction Fuzzy Hash: FA2136A6F0A94E0AFBF0BBA848652B977D0EF6C311F060037C41DC31A2ED186E094381

Function 00007FFD9B8B64F5 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cef3a823bf9ea684fa5fabc07d7f67d24b4b0bd37edf75f1a858fee03ca578dd
Instruction ID: 94b2d3cfe2e91e8e0b9f10a0ef9ede11998a6f6811385d2dd4ce4910a5f47cbc
Opcode Fuzzy Hash: cef3a823bf9ea684fa5fabc07d7f67d24b4b0bd37edf75f1a858fee03ca578dd
Instruction Fuzzy Hash: 41219161B189A94BE7A89B7C84A5678B3D1EF4C704F554578D46AC32DACD18FC028681

Function 00007FFD9B8CC348 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d797b99b4579ae7676bc0e9afd784f700ecf5b4887e93f783945f5d0cf98e53b
Instruction ID: e9781a295b5f011055f758961c36f1b0a093758097ebff3ea3ccbe477d6a21cd
Opcode Fuzzy Hash: d797b99b4579ae7676bc0e9afd784f700ecf5b4887e93f783945f5d0cf98e53b
Instruction Fuzzy Hash: C221E570318E088FDBA4EB2CD498A2577E1FF6D31171545AAD48ACB676DB25FC81CB40

Function 00007FFD9B8C363A Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5ae420766f9e1472afd69311ef9dfa8b184eefe7298dcaf35daed3cc365aee4
Instruction ID: 2d0611069c3268ae78198ee4e3e5b8bc6bc924551a864ac17217e61fb07c92c9
Opcode Fuzzy Hash: f5ae420766f9e1472afd69311ef9dfa8b184eefe7298dcaf35daed3cc365aee4
Instruction Fuzzy Hash: 9531C771608A4E8FDB94EF48C891EEA73B1FF5C310F104266E419C72DADA34E842C780

Function 00007FFD9B8B6D80 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4d2b206b8e831e53a03ac9a05d0e54310a039c0e29e056ff2f4df6e5d3b39d2
Instruction ID: fc7fe2be7f4241d9a953fd83fe47b43d5a6073bf99ffcbcbc81afbbd491f4470
Opcode Fuzzy Hash: e4d2b206b8e831e53a03ac9a05d0e54310a039c0e29e056ff2f4df6e5d3b39d2
Instruction Fuzzy Hash: EF21C221B19E4E4BEBACEB3C9464A76B3D2FF98314701067AD05DC3199EE24F8028780

Function 00007FFD9B8D8988 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2195a315f7b34e23604236882b962e8c375b576fa84b569eb2340af6a1049494
Instruction ID: 5c367d3ff85c8f73b425530936a3a26a38ecc18d66511d3012b2ee066dc7c642
Opcode Fuzzy Hash: 2195a315f7b34e23604236882b962e8c375b576fa84b569eb2340af6a1049494
Instruction Fuzzy Hash: 2D21BA31A0F69E4FDB66EB7858256B97FA0EF56200B0901B7D49CCB1E3CE2459068742

Function 00007FFD9B8B814E Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e9cc45a034243f30ce9b5dbcbdf0bfbf914d1dd8f8753bfb9f294a065cb42ff
Instruction ID: b6926e886a9fefe40984e776c099c7f8d6a783b10532b0cbadc61d7d605c5214
Opcode Fuzzy Hash: 9e9cc45a034243f30ce9b5dbcbdf0bfbf914d1dd8f8753bfb9f294a065cb42ff
Instruction Fuzzy Hash: 1B216131A0DB8D0FD71497749C251EABBE1FF99300F4505BFE089D71A2DE6866058BC2

Function 00007FFD9B8C322D Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca04b850ef6fa138a997128b90fbdb8b6bd7bac98432bd769d3935e96fbdead8
Instruction ID: 7ffaf915d73464c7a079f33cfe0b372e74bfd0bf324a4287742fae7847f5d8c9
Opcode Fuzzy Hash: ca04b850ef6fa138a997128b90fbdb8b6bd7bac98432bd769d3935e96fbdead8
Instruction Fuzzy Hash: E121F262F0A55F4AFBB4BBA458336B976D0EF8C312F560177D01DD30E2DD296A0B4682

Function 00007FFD9B8CC7D8 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c13152f0fab102c9f6b0919271008b9bac615b743e46a556117d2c51c8db9661
Instruction ID: 849702498259f89af8b1dff12a864c8e2112ff5f00e4a1dfb6f3ed68daf12273
Opcode Fuzzy Hash: c13152f0fab102c9f6b0919271008b9bac615b743e46a556117d2c51c8db9661
Instruction Fuzzy Hash: 4E11E762B1DD190BEB3C729CB4685B967C5DB9D76170241BBF00DC72E7EC186D4242C5

Function 00007FFD9B8C2E2D Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a9b906476d7137b5651e1f55cf6ddbb172998c5e40978d25a7aea441a58e512
Instruction ID: edcbd172c8ed3c1286fd0ef4aaa932967a4734b3155608ff4a51266fb1777117
Opcode Fuzzy Hash: 8a9b906476d7137b5651e1f55cf6ddbb172998c5e40978d25a7aea441a58e512
Instruction Fuzzy Hash: 1721F2B2E1A55E4AF774BFE458316B976D0EF4D310F4602B7D01CD34E3DE286A1A4681

Function 00007FFD9B8C300A Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ffeb192920311e79fbbbbeaaf6e6edb76460b5eb29a5e55a3bcb2ce5ffa130e
Instruction ID: 682494637d59162c0693072cb4eceede98e7db6806c2305bd0430c4f9cb07115
Opcode Fuzzy Hash: 7ffeb192920311e79fbbbbeaaf6e6edb76460b5eb29a5e55a3bcb2ce5ffa130e
Instruction Fuzzy Hash: 55311E74614A4E8FDF94EF48C891EAA73F1FF68304F104669E41AD7295CB35E852CB80

Function 00007FFD9B8B8E30 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bccda653aa56e2ac851e835cce9f5165ee0e6f5356aba60303943f69a70097f5
Instruction ID: 97a4ef06ce7492981a274e9b9e2dd65d5f0d9c48dedfcbdc38405d4d6edaac1f
Opcode Fuzzy Hash: bccda653aa56e2ac851e835cce9f5165ee0e6f5356aba60303943f69a70097f5
Instruction Fuzzy Hash: C521A472F0995D6BEBA497B854352BD37E1EF5C344F054076E00DC21A2EE385A014BC1

Function 00007FFD9B8BF641 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c8a31076ba08abb375ddaae5cc718c9b927b0060b9d36055524310a0d53d14c
Instruction ID: fdaf848ba1e9f2d8b0528e4384f6ad73654f39885dbd1690bb194ff341c770f0
Opcode Fuzzy Hash: 0c8a31076ba08abb375ddaae5cc718c9b927b0060b9d36055524310a0d53d14c
Instruction Fuzzy Hash: 8221B326E0A5AE49F7B493B84C356B977D0DF4E310F5501B9D41CC34E2DD1C2A0A4AC1

Function 00007FFD9B8BBC56 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd3195dce8b1c862f86340f873fc34037eb85d3c82d9b87fff2e4ce654752695
Instruction ID: 43d21c4047bb718aaa3447b2cd531827b3f027fb989bf5a369f6e0eb0a954620
Opcode Fuzzy Hash: fd3195dce8b1c862f86340f873fc34037eb85d3c82d9b87fff2e4ce654752695
Instruction Fuzzy Hash: 2721C521E0A9AE4EF7B597B448322F976E4DF4E310F8A05B5D41DC71E3DD1D2A0A4AC1

Function 00007FFD9B8C81B5 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 064f49c12271014c410d9db40d17eab0f27a6c7709bf2465230aabb3da7b9ddc
Instruction ID: 9b4078adb7a237ae769d001a67d3622080e430d47bf51a8f133a4cfaa5eaf15a
Opcode Fuzzy Hash: 064f49c12271014c410d9db40d17eab0f27a6c7709bf2465230aabb3da7b9ddc
Instruction Fuzzy Hash: 0D21AF62E8E99E4EF7B1ABA448256F976E0EF4D310F4601B7D45CC34E2DD186A0B4681

Function 00007FFD9B8B0830 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc90c0dbf9d6bee4daaf380af05c68becdb9bc2a203188c48183194fd931740b
Instruction ID: 6361e1240f5e2981ee973c74c3175c2ca26cf0cecee89a593e4c9da62cecc9d2
Opcode Fuzzy Hash: dc90c0dbf9d6bee4daaf380af05c68becdb9bc2a203188c48183194fd931740b
Instruction Fuzzy Hash: F011D562F1FBD90FD76547ED2C210A83BA0EF4A650B0A41B7D498C70A3D8195F0587C2

Function 00007FFD9B8C50DE Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33465a7c9b1ef72019396a07d2f8c3ce052e7a73eddf455e5c2642d72277a2b8
Instruction ID: e3021541dd51630bccfbbda70f5ffc174381770657b0f09e66ffee741c17a8cc
Opcode Fuzzy Hash: 33465a7c9b1ef72019396a07d2f8c3ce052e7a73eddf455e5c2642d72277a2b8
Instruction Fuzzy Hash: 4921A161E0E99E0DFB75B7B4183B2F876E1EF4A310F4611B7D41DC34E2ED192A1A4681

Function 00007FFD9B8D7DF5 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f563ea421b63e15c815889943d25e072c78971a369e9797c2a14fbaef8ec08d
Instruction ID: 49904ed7bb6eb61c1751ff552f9454cd44c2bb4ac29cf3c2706d2b47236ed4ac
Opcode Fuzzy Hash: 4f563ea421b63e15c815889943d25e072c78971a369e9797c2a14fbaef8ec08d
Instruction Fuzzy Hash: 5721B32AA0E59E4EE771A3A44C212B97BA0EFCA610F0603BBD45CC31E2DD181E094692

Function 00007FFD9B8BC629 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 544e3f7a4b67ed707f2dd9286e87d3d8c113c9f13947b71e098d4d53ec772b6f
Instruction ID: f4b234703f9e62cafd19a9605153e374563d8a22b1e1337c1f96b0f727dac734
Opcode Fuzzy Hash: 544e3f7a4b67ed707f2dd9286e87d3d8c113c9f13947b71e098d4d53ec772b6f
Instruction Fuzzy Hash: 3D21C531E0A56E4AF7B093B4883DAB979D0EF4E310F56117DD41CD34E2EE186A194EC1

Function 00007FFD9B8D1325 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9a4346615d558ab229d32ac1b3ad62010ec4c79edff0e54c31d3a6de62e63b9
Instruction ID: c86378c4bd86a7bcb148cb525bc33d61a9dbb25594e2f6a9838f3769b67b0d1c
Opcode Fuzzy Hash: e9a4346615d558ab229d32ac1b3ad62010ec4c79edff0e54c31d3a6de62e63b9
Instruction Fuzzy Hash: DA01DB2160D6890FE32DA76D6C5A9B1BBD4DF5A22030503FFE19DC35A3ED056C528382

Function 00007FFD9B8BF0C9 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a681e660c814445ead8a91f9deba779a654576a4e8a472be3db0df0e8dbf011
Instruction ID: 0523c440640bc490e2921004d132c8e3b13a2926ce72c11ad11bab8ea1402d6f
Opcode Fuzzy Hash: 4a681e660c814445ead8a91f9deba779a654576a4e8a472be3db0df0e8dbf011
Instruction Fuzzy Hash: E5119631308A4E8FDB84EF28C8959A537E2FF98310B1045A9D419C73A5CB35EC51CB41

Function 00007FFD9B8C5D4A Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7422f2ca05a03c3fc085cc2ed3c4ab575b189455d9ba7c4ab35b723bedea4869
Instruction ID: 1ed3ac747ae48f2afac6baf9953dd2ecbe7947055384acad083851d9ea26f012
Opcode Fuzzy Hash: 7422f2ca05a03c3fc085cc2ed3c4ab575b189455d9ba7c4ab35b723bedea4869
Instruction Fuzzy Hash: EE21A471719E4A4FDB98EB18C4A4AE577A2EFAC31071442B9D01EC71E6DD24EC42C740

Function 00007FFD9B8CEE58 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63dff81da4c9060d4b310c68e3d9cca162d23b12ab5423d696d924fd559619a8
Instruction ID: f73e1e2745ef887c0ed44bfe91e2873bde77b139af64acb098c06f4ac3a4e121
Opcode Fuzzy Hash: 63dff81da4c9060d4b310c68e3d9cca162d23b12ab5423d696d924fd559619a8
Instruction Fuzzy Hash: F611E3B1B0990C4FDB68EB5CE8959B877E0EF48350F4101BAE44AC76A1DE20BD428780

Function 00007FFD9B8B80BB Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18e675e638a8ba6ddad186d87757b3241846d18d2de9a8793ec85153e8fd19f4
Instruction ID: 8ecb4ec6c628e83858b8e211ab2612513ac182dbc95ddc1baa760f75f6c0355a
Opcode Fuzzy Hash: 18e675e638a8ba6ddad186d87757b3241846d18d2de9a8793ec85153e8fd19f4
Instruction Fuzzy Hash: 82113A52B2ED8E0FE79CAB3858255BCA782EF9415474442FBD05EC31DFDD2458434381

Function 00007FFD9B8CE004 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 382b53a9b15f94c3b3d63400040b2e4cd4529b66dc8eb620c0259e186e53d465
Instruction ID: 01e031eaf416be48c2d5ee9735e559dec5740d65a6bb191c2644a5d865b41c31
Opcode Fuzzy Hash: 382b53a9b15f94c3b3d63400040b2e4cd4529b66dc8eb620c0259e186e53d465
Instruction Fuzzy Hash: B5112931709A098FDBA8EB6CA894A7173D2FF9834171505E6D058CB266DD26EC828740

Function 00007FFD9B8D5788 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 462d309014ab669312c74339d01def243669de5b09f172fc9b20b9c8d17b5b90
Instruction ID: 353ecac77d18be93e03340e0ecb0351a3295ed4b44b6da58b222890edbc7eaeb
Opcode Fuzzy Hash: 462d309014ab669312c74339d01def243669de5b09f172fc9b20b9c8d17b5b90
Instruction Fuzzy Hash: 0E11A9B1E59B09CBE72CDF68845207577E1FB896217101A3FC5D783A72C735B8038A40

Function 00007FFD9B8CFEA8 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e978dda76c19bb50fcfe37903a31bd50baf819ede2c8a871d5fad597aa9dc8a
Instruction ID: d34456a2bb5a6cda52615273b251731b52e19f92bf644b0da98c784f9ca3a384
Opcode Fuzzy Hash: 7e978dda76c19bb50fcfe37903a31bd50baf819ede2c8a871d5fad597aa9dc8a
Instruction Fuzzy Hash: 8D017C6170AC4D4FEB94F7AC98AD6B827C2EF6C61230901B7E40DC72B2DE44AC858340

Function 00007FFD9B8C083D Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1ba16781ecafb3038528c139e7cb51a7384571685eee70dff97a0a01b69120e
Instruction ID: bed4f383498b6ebba6c3496089422896e8912ab4a1b20644e6d466e8aa3213fa
Opcode Fuzzy Hash: c1ba16781ecafb3038528c139e7cb51a7384571685eee70dff97a0a01b69120e
Instruction Fuzzy Hash: 25112930719E498FD3A9F73884A556833E2EF9C31134105BAE40DC37D6DE28AC828781

Function 00007FFD9B8CD4B0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c53ffc0a1e1212317725d2cc50b0f029b8e4ab79fd17ad53b7f20f356744338
Instruction ID: aa7e7d4b4fac60b2e21324e160717bee9ad08efb61e8d625c717aaa2699d5038
Opcode Fuzzy Hash: 6c53ffc0a1e1212317725d2cc50b0f029b8e4ab79fd17ad53b7f20f356744338
Instruction Fuzzy Hash: DD012671A0E9594FE725F76858355F83BA0EF0631430900FFC089CB1B3DA081D498395

Function 00007FFD9B8C0850 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a2fa4d86fd011a63e16532bd0d66edfaf5fbdeca7db63f670970ed9614e4eb6
Instruction ID: 52ca05a15627e4373fd796a29bbf314e6b51f577bc9a96046daa6dad6367e5b9
Opcode Fuzzy Hash: 1a2fa4d86fd011a63e16532bd0d66edfaf5fbdeca7db63f670970ed9614e4eb6
Instruction Fuzzy Hash: 1C01D230B25E1A4FE3A8F73C949596973E2EF8C7013400579E40EC3699DE28ACC28781

Function 00007FFD9B8B3646 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf2e33383b8e5d826ed72f91d50d445258d12044b659a9aac15559481bced0c8
Instruction ID: 484af08885cb9eb5facfd919f7d183b316f16139f7e00fc72fcf654401db014f
Opcode Fuzzy Hash: bf2e33383b8e5d826ed72f91d50d445258d12044b659a9aac15559481bced0c8
Instruction Fuzzy Hash: 2C01F53150DA594FF365AB78984D6327FE0EF6A211F0500BFD448C7273EA25A881CB51

Function 00007FFD9B8BABF5 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ce0918629ae42c542e87b9790705f98c06fccc85c634df28f60923c63becc26
Instruction ID: 37343b6c9e3ecfc8b0948b68bdb40a965144f76f1cf2ff1130c48c9e987c424c
Opcode Fuzzy Hash: 5ce0918629ae42c542e87b9790705f98c06fccc85c634df28f60923c63becc26
Instruction Fuzzy Hash: 9111E571A0E79D5BDB628BB848750E93FB0EF49300F0540D7E048D61B3DE384A058B81

Function 00007FFD9B8D197C Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21d22b974a9f35e6b4e2e88f6d36438ffe88fc9f61b4f0bc47e7f6734bd85cbd
Instruction ID: 3669c252ed16e8067310ca48050317571be75607163d17f18caf38020715a2aa
Opcode Fuzzy Hash: 21d22b974a9f35e6b4e2e88f6d36438ffe88fc9f61b4f0bc47e7f6734bd85cbd
Instruction Fuzzy Hash: AF01B531B1EA5A4FE778E76894A4371B3E1FF8C215F45037BD08EC6192DA6CA986C341

Function 00007FFD9B8CAD09 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71d4cec3b18201d95bdd9817627473084375d97dd2280923bab2acc25161c63e
Instruction ID: d090985de95fe565d74fac8a5da08a3c0a86f6812d4669050190a1c2b88b16ba
Opcode Fuzzy Hash: 71d4cec3b18201d95bdd9817627473084375d97dd2280923bab2acc25161c63e
Instruction Fuzzy Hash: 1E110271A0EA5D9FD3B9EB2898604B17BA0EF4921071545FFD14AC35F6CA29B9418740

Function 00007FFD9B8D74BD Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68cdaa622387e41561c5fec1a80ca6457c0cfc8c45a287ffe010fa17e56fe011
Instruction ID: b36a90cec1259ea993a889bbed1f1ee93729e246ce871eda5996bd97a0da8617
Opcode Fuzzy Hash: 68cdaa622387e41561c5fec1a80ca6457c0cfc8c45a287ffe010fa17e56fe011
Instruction Fuzzy Hash: BE014862A4FAD54FD76B976D48758647FB1AE9A20030A01EFD499CB1B3D9099C09C312

Function 00007FFD9B8CAE28 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 277bb0c9f8762ab6abed7e594c139d405a2caa83ed24104e90ad2659b02ac93c
Instruction ID: 9d0eac96889dedd123e012b24cf84175407bed1646c8ab77eeab14f7427d2c98
Opcode Fuzzy Hash: 277bb0c9f8762ab6abed7e594c139d405a2caa83ed24104e90ad2659b02ac93c
Instruction Fuzzy Hash: 1B01F96272DD4E0BFBACA75C64E56B573C2DB58350B0401B6D40DC729FED29ED4242C0

Function 00007FFD9B8D260E Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bcb66282d69266103982aebf979982e8be022b8d9b66f81dbeec0da588a3018
Instruction ID: 857857c593e9253a35d38b3719da0b7699cd3f5ac16d4514c5e170f32ec2c614
Opcode Fuzzy Hash: 3bcb66282d69266103982aebf979982e8be022b8d9b66f81dbeec0da588a3018
Instruction Fuzzy Hash: 21018231B0E70A4AE3755BA4E4503757391BFC9320F224B3BD4DA466E0DF3AA6828344

Function 00007FFD9B8CAC8A Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edae5f47e279b377fddaf4d06b097e8eefb82f433c8630aaf8071a7dd3019a16
Instruction ID: aebe0ad8e617e5f8175158698ec1fab6b14c7e9badf99855fe6acfbcd37435c0
Opcode Fuzzy Hash: edae5f47e279b377fddaf4d06b097e8eefb82f433c8630aaf8071a7dd3019a16
Instruction Fuzzy Hash: 6E11E572A0DA8A5FD76AFB3898604A17BB0FF1920071505FBC04AC71B6EA35B845C781

Function 00007FFD9B79EE22 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1744890126.00007FFD9B79D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B79D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b79d000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d25c7eb8dd6594b1aec66c69fb5898b37438277ad93f548f2c70b7ffad92659b
Instruction ID: 20b326e987305fcfa375ce8524e79206d70b22c18d501342dace60f1f5834ad0
Opcode Fuzzy Hash: d25c7eb8dd6594b1aec66c69fb5898b37438277ad93f548f2c70b7ffad92659b
Instruction Fuzzy Hash: 7E011D3260CE088F9BA4EF1EE481D5277E1FB98320711069AD45DC766AD731F892CBC1

Function 00007FFD9B8B1290 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 295a62f36f7d18f39936be481c75bbae1fcb02b1f0538de80d0ff1fb696d20a8
Instruction ID: 00552666eca7251ca7e731bebf6329e423f253782ecf48f03d95cd2df4b7be75
Opcode Fuzzy Hash: 295a62f36f7d18f39936be481c75bbae1fcb02b1f0538de80d0ff1fb696d20a8
Instruction Fuzzy Hash: 0FF04921F1DE9A4FD719F77868658E537D0DF4521470805FBC09EC70EBEC28A8468781

Function 00007FFD9B8C10A9 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2f7a5daa21654039800e89ae23d4a8bb212d84e5c4c0920dd9bc516abdc111a
Instruction ID: 2cd76bc9a5ec9e9848c3324e4deda8fab5c9b39cd08493beda52904a93bf87ef
Opcode Fuzzy Hash: f2f7a5daa21654039800e89ae23d4a8bb212d84e5c4c0920dd9bc516abdc111a
Instruction Fuzzy Hash: C0017620A0F69E4FE760F3A59C9063277D4FF59311F0506BBE88CC31A1C91CEA818391

Function 00007FFD9B8CCF58 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eadd27910f9df3e3e57d11df8bf4af0336e0e6daf360494013c12e43ad6ef1a1
Instruction ID: 025f6c6a008b62d73b53a444cdde82d93e6bac540f88aa05646f6676847e8749
Opcode Fuzzy Hash: eadd27910f9df3e3e57d11df8bf4af0336e0e6daf360494013c12e43ad6ef1a1
Instruction Fuzzy Hash: 66F04C5371EE490BF36897BD34941B003D1DB9C6A070552B7D46DCB3E6EC481D860380

Function 00007FFD9B8C3F43 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0edbbe2d2a6943fce6f654996f68225c0297869a04ee22c964fb2f2c2fe9dba7
Instruction ID: fae707184bd1f45395a0b0057f5d90c895b8815651f0fb1dc7885b45cb367a82
Opcode Fuzzy Hash: 0edbbe2d2a6943fce6f654996f68225c0297869a04ee22c964fb2f2c2fe9dba7
Instruction Fuzzy Hash: BEF06271B0C9198E9B5DBA5CB812DFC73D0EF85320B1001BAE01DA31CBDD29780346C1

Function 00007FFD9B8CCEE0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55421cc56254f089513c086d7783257e6fb5ef4279ddaad407fa0b2d91d78f62
Instruction ID: 0f02c1b3f233c84ceb08a2e4df8a7d2054865a701c4c6ea7a1741699d97a1534
Opcode Fuzzy Hash: 55421cc56254f089513c086d7783257e6fb5ef4279ddaad407fa0b2d91d78f62
Instruction Fuzzy Hash: CDF01920B2881D8FDBA8FB6D8451E7573D1EB5D314B1244A5945EC72A6D924EC81CB81

Function 00007FFD9B8B130D Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 185c2e0c3b9ea0ed621d6f401300351f9e0e35b6b498b933db19a0817bcacd58
Instruction ID: b9178d096da9cf00c3f03bd30754dfe3ca01c4cc674fb72b2476b26a6ec77077
Opcode Fuzzy Hash: 185c2e0c3b9ea0ed621d6f401300351f9e0e35b6b498b933db19a0817bcacd58
Instruction Fuzzy Hash: 21014932A1D98C1FD761EBB488799F9BFE0EF4E200F4900F6D84CC74A2ED2866448780

Function 00007FFD9B8D665D Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb4c5279a3572d2f0b5be3173c4d8ebeb743b003398e82e5baca6a980ec37d69
Instruction ID: de670030701e61aa0874461ffaa5d78357102fe8035e991d948b6c3a09941646
Opcode Fuzzy Hash: bb4c5279a3572d2f0b5be3173c4d8ebeb743b003398e82e5baca6a980ec37d69
Instruction Fuzzy Hash: B101F57060968D8FCBA1DF14D8613E93FA0FF4A300F45029BE81DC71A2CB769A18C742

Function 00007FFD9B8D836D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b8bf501f4c864bd663527934e8d7999931c030000ee60e3f0bc82f3bfed6a7d
Instruction ID: 6c3e7d114d3b7980c5d363bc349264dae758c55d40bf62b8076f5b7935020821
Opcode Fuzzy Hash: 4b8bf501f4c864bd663527934e8d7999931c030000ee60e3f0bc82f3bfed6a7d
Instruction Fuzzy Hash: 23F0F951B19D8E0BEB5DE72C49A68686382EFA869070442FEE05EC31D7ED14B9074345

Function 00007FFD9B8B7A73 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c64a6c1bde1f3b1a46cba16731032dd5251534101b992205a6cd792793636886
Instruction ID: 9e19fa7856067a317b2af98dc5271b01866175d06fcd23a2e9dd239ac1e74ace
Opcode Fuzzy Hash: c64a6c1bde1f3b1a46cba16731032dd5251534101b992205a6cd792793636886
Instruction Fuzzy Hash: 5F012831F0892E8EDF90EBA8D851AEEB7F1FF5C310F141876D12DE3191DA24A5408B80

Function 00007FFD9B8C9881 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d2e451044dcfc60b80cc7df3bb95737cadd613b2f860af3c71631d3d329d7b9
Instruction ID: ebab6d428942c91bc9b8d6c58370691ea4ce00c91e2d3678e07900196b35ae98
Opcode Fuzzy Hash: 9d2e451044dcfc60b80cc7df3bb95737cadd613b2f860af3c71631d3d329d7b9
Instruction Fuzzy Hash: 55F0E997B1AE4E0BF7A9A78C24AD27003C2EBED261F1644B7D05CC33B2DC085D438244

Function 00007FFD9B8CCF60 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e63f27eb776a022a4bdba1845c2dc41d078c5104396b72f6516a4b4953753c4
Instruction ID: 2042f91d566bdb2d3898d5186ff4cdf74777f166ba901c3671885859efa99a53
Opcode Fuzzy Hash: 3e63f27eb776a022a4bdba1845c2dc41d078c5104396b72f6516a4b4953753c4
Instruction Fuzzy Hash: 91F05953729E090BE36CA7BD34986B503E1DBDC2A0705A2B7E42DCB3E6EC480D820380

Function 00007FFD9B8B0C8A Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d2185346efe97aa80f150ee8786be6bf9ce05cae02192a14f5589a6635df6c5
Instruction ID: 9a9ad6551ea5ab03b99e4e17e664246dcd92fecc8d28b24feda8022e11e763d9
Opcode Fuzzy Hash: 4d2185346efe97aa80f150ee8786be6bf9ce05cae02192a14f5589a6635df6c5
Instruction Fuzzy Hash: 04F0593210FA0C0FEB18961ADC228F27794FB86624F00011EE08EC2152E612A5138781

Function 00007FFD9B8CD4D0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3707d4f6cd4fef86be418731834ad5baabbeecf302a40f89d89302b24ed24b38
Instruction ID: 4e5a87e29c4b6075618c17b6490cf1e5a349a86ce9f1f6acb0418cce7e5e88be
Opcode Fuzzy Hash: 3707d4f6cd4fef86be418731834ad5baabbeecf302a40f89d89302b24ed24b38
Instruction Fuzzy Hash: 40F0C220A1BA594FF765E77848295B87BE0EF0A30074A00FED049DB1B3DA591E498395

Function 00007FFD9B8BD8F0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945b061845e0a75c920d4bf061c05ad4a9ae815940e10410366486881314edf0
Instruction ID: e5efcfe5fdca8f90818caba19f924c36fb053b70115f2cd875f07ed8862779f7
Opcode Fuzzy Hash: 945b061845e0a75c920d4bf061c05ad4a9ae815940e10410366486881314edf0
Instruction Fuzzy Hash: F7011D30E18A1D8FDB94FB7898596EEB7F0EF58305F60046AE40DD3295DE35A9818B81

Function 00007FFD9B8C981B Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc5769232e33a8fa322fb78d648b0f6578fd0b890655cffa5b12d1ac89b75448
Instruction ID: c57c4ed093101fcb57488f88995073549f27b37562b1caf67a31958c613c7032
Opcode Fuzzy Hash: dc5769232e33a8fa322fb78d648b0f6578fd0b890655cffa5b12d1ac89b75448
Instruction Fuzzy Hash: 0DF08266719E4A0AE3A5938D24A927013C2EBEC261B1641BBD41CC3362DC059D468345

Function 00007FFD9B8CCB4D Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff1e8ca2592962bd67317aa5218f410ba4d849672167505e56117fb9934300e0
Instruction ID: 7da16f50c592e3e6237cc33f9d0c139d348daaea208d6eb8a845779b6d63af8b
Opcode Fuzzy Hash: ff1e8ca2592962bd67317aa5218f410ba4d849672167505e56117fb9934300e0
Instruction Fuzzy Hash: 95F0F671A1958C5FDB14EBA4D8685F8BFB0EF99300F4541E7E848C71A2DE346B458B81

Function 00007FFD9B8C9539 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ddf451e2631fadc731732e3fdc61d111d557342356aa668ca971edc6cd7f2e6
Instruction ID: 85e818afcc0616cee9ddd591e19cca5b7886cea60768c134e23ddcb7a64c122c
Opcode Fuzzy Hash: 9ddf451e2631fadc731732e3fdc61d111d557342356aa668ca971edc6cd7f2e6
Instruction Fuzzy Hash: B2F0623170990D4FDF95EB98D475AB473A1EF9A304F1204A9E00DC71E2CD26ED02CB41

Function 00007FFD9B8C4FB7 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7743ecb2586c49135d2582ec82151248f9bc11ed3847a139d6c783cefdbe20e3
Instruction ID: e5ba8e9c9598fe52aa07ecba7b5ef287dd86b4418d9b4765b39114f0ee799bfd
Opcode Fuzzy Hash: 7743ecb2586c49135d2582ec82151248f9bc11ed3847a139d6c783cefdbe20e3
Instruction Fuzzy Hash: E1F05C7250E71C5FD714A749EC5A9F637A4FBCA324F00012FF08DC2051E2116452C310

Function 00007FFD9B8CB458 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58a334a3917adbd63556366b44b0f6c7bdf1f5dbc0407912f9484262564cd8ef
Instruction ID: a3eedaaf33ce89588753a0b5404108a22fdea971fc32c4cea33de9e7eaf1bd73
Opcode Fuzzy Hash: 58a334a3917adbd63556366b44b0f6c7bdf1f5dbc0407912f9484262564cd8ef
Instruction Fuzzy Hash: 96F046B2A19D4A0AD36CE318A8A56B1B2D1FF98360F0442BBE04EC3195ED647C8287C0

Function 00007FFD9B8B4348 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ccde2140a3c62021a382d8f29a28cf1be79fe0c7dff9708f663fb6dbb6ea577
Instruction ID: 213b97298643e38527b3a1e5756847d9d05edc6bddfb5dedde22e7583e286683
Opcode Fuzzy Hash: 9ccde2140a3c62021a382d8f29a28cf1be79fe0c7dff9708f663fb6dbb6ea577
Instruction Fuzzy Hash: 32F0E232B2C9590BE75CE65CA8116FDB282EBCC320F15427AE00EC319ADD28A80206C2

Function 00007FFD9B8BA7B8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83539a92091b2babab44af71494c52673a550b7ba196a7b14372e25b8e2e2ad0
Instruction ID: d42b8bcdcf56cc85fc58739ad9cba7b7005d554ecb391a9d30124916c8defef9
Opcode Fuzzy Hash: 83539a92091b2babab44af71494c52673a550b7ba196a7b14372e25b8e2e2ad0
Instruction Fuzzy Hash: 1BF0A031A1CA491BD398EA2C98095AABAD1EBD8220F848B7BB84CC2269DE7485414781

Function 00007FFD9B8CE398 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76dcae86cb0b92a7af484e3265baf6792546b6fca85c39eaef61245d346a3e18
Instruction ID: e98af9264adf0d3908caa7cc4eb3f3644bdfb820ebd864744fb9bc5ae85d6676
Opcode Fuzzy Hash: 76dcae86cb0b92a7af484e3265baf6792546b6fca85c39eaef61245d346a3e18
Instruction Fuzzy Hash: 5CF02732A0A0048FCB05BB38D86E8E43B70EF1422871901E7C01DCB0A3FA0BA557CB81

Function 00007FFD9B8BBA09 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad8ebf78c1878d1ac398e9cfba48aa3f9ab2211fbfdd5b2038a55eb39088c6c2
Instruction ID: aaa33a2ba71c2983edfb167de490d84b732676f5a2025f3c7fdcf0a10ce91b7a
Opcode Fuzzy Hash: ad8ebf78c1878d1ac398e9cfba48aa3f9ab2211fbfdd5b2038a55eb39088c6c2
Instruction Fuzzy Hash: E1F0903180D68C8FCB55EF64D8259DA7BF0EF5A311B0502ABE448C7162DB249A48CBC1

Function 00007FFD9B8CFC2B Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6655b37f85ac00f9a8714c12eaaca1e93d56d0018db2b717506414d169e3e706
Instruction ID: 9d69fa310c1421db1218acdd00b0e36009c4718f2fd81880cc2acb9acd0beb96
Opcode Fuzzy Hash: 6655b37f85ac00f9a8714c12eaaca1e93d56d0018db2b717506414d169e3e706
Instruction Fuzzy Hash: F1E0C07250FA1C0FEB54AA597C15CF2BFA4DE89374F00005FF40CC2122E1119412C351

Function 00007FFD9B8B6CAE Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1f606b5cce6a4655e2dead4f7fcfa3ac413259d2db4427e448d5bab0391e729
Instruction ID: 1c852becd08ec8d924347e5901ee69c9e328bb2e13c6cb57ea700d75e1849342
Opcode Fuzzy Hash: c1f606b5cce6a4655e2dead4f7fcfa3ac413259d2db4427e448d5bab0391e729
Instruction Fuzzy Hash: 2EE09241B2EAE90AFB7657B819762606BE1DF9A21078E80D6D04CC52A7DC4C994583C2

Function 00007FFD9B8B1F5E Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d22aed5cce88b14a32589915b54154eb3cb23dd1b4f4407bb28641798d866e9
Instruction ID: ffc5ce16cc7d7a0ec8ef7c0468e4d835c685e62f7f9d55459860a2b5367966fb
Opcode Fuzzy Hash: 5d22aed5cce88b14a32589915b54154eb3cb23dd1b4f4407bb28641798d866e9
Instruction Fuzzy Hash: D1E09B21F1D4050BD3587B7D682717DA2D2DB8C220F0515BEE45EC32AACD1C98454181

Function 00007FFD9B8D66C8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51248eb03804342f1636c772dcfdb58c224bcbd89151c94b7e46b0779db7bc71
Instruction ID: 7f946c908e463d5f79f4001049d8c1b6144d77918b2e40280ab1245765b0a3ba
Opcode Fuzzy Hash: 51248eb03804342f1636c772dcfdb58c224bcbd89151c94b7e46b0779db7bc71
Instruction Fuzzy Hash: B0F03770514A4D8FDB94EF68C45576533E1FF98314F91067AE81EC71A1CB35E996C700

Function 00007FFD9B8D89EE Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f34f091ab490079334b2254632b633f6e1802df38ab2474213f74e9452297193
Instruction ID: dd6d2a298dc468afcc9cd82f41c729b036082ad916b51b25eec582a435bbd4c4
Opcode Fuzzy Hash: f34f091ab490079334b2254632b633f6e1802df38ab2474213f74e9452297193
Instruction Fuzzy Hash: C4E0203290D98D4BDB50AF59AC159E97BA0FFC9308F01036AF55CD3191D7265952C782

Function 00007FFD9B8BACC1 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f1834ab1f12696221876909b85b93e95ade4deef3e97dbfdb9e4d90eb65e2b1
Instruction ID: 409ae8500175b15e66a51cecba03e7ba3e66da44dd30703bd040530f296bd9ae
Opcode Fuzzy Hash: 4f1834ab1f12696221876909b85b93e95ade4deef3e97dbfdb9e4d90eb65e2b1
Instruction Fuzzy Hash: 14E0203194EA1C5FCF58ABA958251E537A4FF4C304F01015AE54DC3191D6365A95C7C1

Function 00007FFD9B8D0957 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5071fa6170d11fd1ad3a91d4e642fb18cdd93166eac1ca256ffc1c7a7044a8ba
Instruction ID: 74958cff7078e5e74c36b9a70bab80d45eedf72e285da9127f14bce96e78de21
Opcode Fuzzy Hash: 5071fa6170d11fd1ad3a91d4e642fb18cdd93166eac1ca256ffc1c7a7044a8ba
Instruction Fuzzy Hash: E9D01722B2D8280BE26CD68CB4223BDD2C2E7CD735F1103BFE08EC2295C85A49524289

Function 00007FFD9B8BBA20 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d0d450af0bd614ff690e83f84406e1fcc83a3c9ecd33567353765081f9bfafa
Instruction ID: f15e8a0501eb2ca054230dbecfb22ddf62e76f56cd855e8c525e1574125a6536
Opcode Fuzzy Hash: 4d0d450af0bd614ff690e83f84406e1fcc83a3c9ecd33567353765081f9bfafa
Instruction Fuzzy Hash: 55E0B671818A0C9F8B48EF18E8498DA7BF0FB69315B01025BF419D3260DB719A98CBC6

Function 00007FFD9B8B4B10 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59897557151bbd42f63037123fd96ec3e36f0efbb2b397292494049e16e08a6e
Instruction ID: 4e343285e399da44d306f341f4e5d27a2561ff3900d2c7fdcdab6f858c8338c9
Opcode Fuzzy Hash: 59897557151bbd42f63037123fd96ec3e36f0efbb2b397292494049e16e08a6e
Instruction Fuzzy Hash: C1D0C241B2993E07F7B867BC38621F46281EB4C214B0180B1A00DC119AEC086C8102C0

Function 00007FFD9B8BE99D Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc4461cd39d559c3958d498c71c5a03618f0f2f621e66fd433105092b8cceb7f
Instruction ID: 777e5f751a7ea9ba3f68f78d361909c5d0f929007e19195b7ccdefac85672d2b
Opcode Fuzzy Hash: cc4461cd39d559c3958d498c71c5a03618f0f2f621e66fd433105092b8cceb7f
Instruction Fuzzy Hash: 01D05B21F4581D4DEB94B7B42C365FDF195DF89105B910875D41DC31C7DD1D151545C1

Function 00007FFD9B8B5149 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0ea00c7c2a00fc8df10b4b1c13c59bd38d6c79a1586da50e585b6de07243253
Instruction ID: 5feb369afccb0890098b117c2487822d096f5bea50a2eae56d7d86bf0842ad78
Opcode Fuzzy Hash: a0ea00c7c2a00fc8df10b4b1c13c59bd38d6c79a1586da50e585b6de07243253
Instruction Fuzzy Hash: 9CE0C241A2F95F0AEA2137BD0872168A980DF1D680F4B00B4D808CB0F3FC089A4886C1

Function 00007FFD9B8C66CD Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44b7cdc790641dee78c5e93b582f4e1ab723586ddf6f32761ba598bad9defab3
Instruction ID: 6381ab8704fa59b8c4f2841219165115ac03c6e09fb44af9fe7aba69c37b0eb7
Opcode Fuzzy Hash: 44b7cdc790641dee78c5e93b582f4e1ab723586ddf6f32761ba598bad9defab3
Instruction Fuzzy Hash: B2D05EA1F4581E4DEF58B7B46C36AFDF295EF89204BC10476E41DC30DBDD2E6A110682

Function 00007FFD9B8B81C0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cce48a24938749cf24f920ff8c6bf1abaf83fcd2c02cdf5c6815e55e88946b35
Instruction ID: dab317259c45cface20188666ff48816c86cc2ee35b2b5865d601d3b32853f0f
Opcode Fuzzy Hash: cce48a24938749cf24f920ff8c6bf1abaf83fcd2c02cdf5c6815e55e88946b35
Instruction Fuzzy Hash: 63C0123255DA5D47C301A7A4E8618EAF350FF90310F510A3AE04A920A9EDD8A64486C2

Function 00007FFD9B8C5EA5 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0ec4b9b3d28acc1c5700ff680256ae397d83b7c345170c5a1b34e9abcf176c4
Instruction ID: bbcc910f42ece0e9d4dcb939c59d575dce34bb61f1ace8ca0bf51cb752a9166c
Opcode Fuzzy Hash: d0ec4b9b3d28acc1c5700ff680256ae397d83b7c345170c5a1b34e9abcf176c4
Instruction Fuzzy Hash: ADC04CB3A4E11948E724319478130F8B350EB45175B511137D24A82852591625264586

Function 00007FFD9B8BF61F Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d713071db197eae685edd9ef04c27ccb4c2c0c088bc2e0445a5c695cefe4b7e
Instruction ID: 0ff15824a165f1595a51e577c77dd25bf8ff7c69fccaf4de83c78ccb5106bc81
Opcode Fuzzy Hash: 5d713071db197eae685edd9ef04c27ccb4c2c0c088bc2e0445a5c695cefe4b7e
Instruction Fuzzy Hash: 15C0123255DA4D4AC785A754EC51CDAB750EF90254F801E3AF04B910A9DD58668586C2

Function 00007FFD9B8BFBF9 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed93a1426e417b063078d583427c3367199f6ba42155c49065dd649967281b29
Instruction ID: a825e4a49dc250481b2950b1ea3a79f0471ca8ed6940f594b50bc501517f46ad
Opcode Fuzzy Hash: ed93a1426e417b063078d583427c3367199f6ba42155c49065dd649967281b29
Instruction Fuzzy Hash: 6CC012715146544BD714AA5484464E633D1FB98201F801A6AEC89DA261DA28964646D2

Function 00007FFD9B8C3A86 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c213f55b579bba55cdfc8111a975ac23469d25b51277c1886033b8d5221ebc2
Instruction ID: 670bdcd8725b969e3ffc543a3b6bb98ce78fd9e21ca2860fef04944e10dedd26
Opcode Fuzzy Hash: 3c213f55b579bba55cdfc8111a975ac23469d25b51277c1886033b8d5221ebc2
Instruction Fuzzy Hash: 89A01206F4901100B24434587C410E4E3018BC0075A544932D4144008DD89E11821141

Function 00007FFD9B8BD9DC Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04cdc590979b7b5acb759338bf27d20efc39ffb47fed8b4a0b2063fc3330dc67
Instruction ID: ba4a3f8c41b74867e9d3586a6532c6e4d3106513ec561c911b91b2fa04309918
Opcode Fuzzy Hash: 04cdc590979b7b5acb759338bf27d20efc39ffb47fed8b4a0b2063fc3330dc67
Instruction Fuzzy Hash: A4B09221A8A45D5ADF2067B028260E83244EB8C204B420572A80D82192DD29A6240D80

Function 00007FFD9B8C8534 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5997799e527573da5b63e1ce92d560c601f98cde6fd867b8ff95c5e1eedea6a0
Instruction ID: cfc006e78380ac0dab02635496cf69fc98951e55e3d7b98b6685577188c839c0
Opcode Fuzzy Hash: 5997799e527573da5b63e1ce92d560c601f98cde6fd867b8ff95c5e1eedea6a0
Instruction Fuzzy Hash: 0FB0123384E02C4CAF2466443C010F8B350E709130B131113C1022104069466D2200C0

Function 00007FFD9B8BC227 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2da78cb737e959a1fd27120c93aa7ba3bd5cb14389c0c3f9e2f4bbf1902c8cb
Instruction ID: 92e031241ae474ba1ab234afc7315351f22a57d2cb58fb1d88f4d9df301d916f
Opcode Fuzzy Hash: a2da78cb737e959a1fd27120c93aa7ba3bd5cb14389c0c3f9e2f4bbf1902c8cb
Instruction Fuzzy Hash: 74A01233B4102D808B2081C4B4100FDB310E788121B110033D22DC10105511112809C0

Non-executed Functions

Function 00007FFD9B8B04F2 Relevance: 7.8, Strings: 6, Instructions: 302COMMON

Download Yara Rule

Strings

L_^f, xrefs: 00007FFD9B8B0722
L_^t, xrefs: 00007FFD9B8B075A
L_^P, xrefs: 00007FFD9B8B06C9
?L_^, xrefs: 00007FFD9B8B0501
L_^N, xrefs: 00007FFD9B8B06C2
L_^v, xrefs: 00007FFD9B8B0762

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID: ?L_^$L_^N$L_^P$L_^f$L_^t$L_^v
API String ID: 0-3730446074
Opcode ID: 337ec68c94d713dc76797dd492ae001603007e8a691d99b3b141e922d16c25b7
Instruction ID: 26cf90dbdc90cd7317764a3ca74eee6c40159a19602bf423252ea1b83563d347
Opcode Fuzzy Hash: 337ec68c94d713dc76797dd492ae001603007e8a691d99b3b141e922d16c25b7
Instruction Fuzzy Hash: 8F81DE43B0E17685E31A33FD796A4E92B40CF8277DB0846F7D1ED4A0D7AC49208796DA

Function 00007FFD9B8C89DD Relevance: 5.1, Strings: 4, Instructions: 104COMMON

Download Yara Rule

Strings

J_^, xrefs: 00007FFD9B8C8A62
J_^, xrefs: 00007FFD9B8C8A22
, xrefs: 00007FFD9B8C89FC
J_^, xrefs: 00007FFD9B8C8AC2

Memory Dump Source

Source File: 00000002.00000002.1755494231.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b8b0000_Update.jbxd

Similarity

API ID:
String ID: $J_^$J_^$J_^
API String ID: 0-510385267
Opcode ID: c595409eedf9d46fb70e6d7525d40fdf75f7680f1cad39e2d9cec5cc2f312af6
Instruction ID: 956fd6f027a33b352f2a0c562c9528168b9920d596e0ed771ee3772a7d8bf6f0
Opcode Fuzzy Hash: c595409eedf9d46fb70e6d7525d40fdf75f7680f1cad39e2d9cec5cc2f312af6
Instruction Fuzzy Hash: 0131B6B260E1E24FD31B976968640D57FA2FF5126C70D42F7C0E88F193F918584B8795

Analysis Process: Treatments?Secure.exePID: 1456, Parent PID: 6544COMMON

Executed Functions

Function 00007FFD9B89400E Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15a1a32fa94b94f2d3d91e7713f9ff4367ec17a307578433b33314601497b77e
Instruction ID: 08d2417a6ed4bc615e98c75408637115bfe58b346e98e15cf8e43d96abee1857
Opcode Fuzzy Hash: 15a1a32fa94b94f2d3d91e7713f9ff4367ec17a307578433b33314601497b77e
Instruction Fuzzy Hash: 0FC12530E1851D4BDB6CCB9884A16B8B7E1FF48305F6981BDD19BC3292DE34A9838B40

Function 00007FFD9B8930E6 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c1fb37cc6654a1a38a04aa5ea1054b07e7f66fe1e72b5fe0aad6780cab1dd4e
Instruction ID: bed14978e6954cccb1791f41c10e1adc573712aa989bdcc655cc9cd83b91c548
Opcode Fuzzy Hash: 1c1fb37cc6654a1a38a04aa5ea1054b07e7f66fe1e72b5fe0aad6780cab1dd4e
Instruction Fuzzy Hash: F481FB78E0451E8FEF58DB99D4A5ABDBBB0FF58311F01216AD01AEB291CF35A941CB00

Function 00007FFD9B893C6F Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d9c33a4ea33b7c6fca0093da2bf1f8375596ae43d98117072d2f8faaeeab673
Instruction ID: 203d50a0c56a9172c060dc7653495fccd32d66a024de9c03eb9ad753d9676333
Opcode Fuzzy Hash: 7d9c33a4ea33b7c6fca0093da2bf1f8375596ae43d98117072d2f8faaeeab673
Instruction Fuzzy Hash: 20518C71F096098FEB68DFA898616ACBBE1FF59314F05016AD00AD77A2DB346A01CB45

Function 00007FFD9B891124 Relevance: 19.9, Strings: 15, Instructions: 1176COMMON

Download Yara Rule

Strings

8C;7, xrefs: 00007FFD9B89191D
+A;7, xrefs: 00007FFD9B891D40
WA;7, xrefs: 00007FFD9B891C0B
xB;7, xrefs: 00007FFD9B891A67
fC;7, xrefs: 00007FFD9B8918E1
uC;7, xrefs: 00007FFD9B8918A5
uC;7, xrefs: 00007FFD9B8918C3
SC;7, xrefs: 00007FFD9B891887
nA;7, xrefs: 00007FFD9B891C29
7C;7, xrefs: 00007FFD9B89193B
kB;7, xrefs: 00007FFD9B891AA3
8C;7, xrefs: 00007FFD9B8918FF
<B;7, xrefs: 00007FFD9B891AFD
xB;7, xrefs: 00007FFD9B891A85
%A;7, xrefs: 00007FFD9B891D9A

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID: %A;7$+A;7$7C;7$8C;7$8C;7$<B;7$SC;7$WA;7$fC;7$kB;7$nA;7$uC;7$uC;7$xB;7$xB;7
API String ID: 0-1664289608
Opcode ID: e973196dd239f4b3e3fb34371bb2a570b64ac3f3e4cf08b9bcbb509e4c08f718
Instruction ID: 48bab89cafc6c95d15d7e29333a786b3ca858ac79c5293e671dc860b1875ce2f
Opcode Fuzzy Hash: e973196dd239f4b3e3fb34371bb2a570b64ac3f3e4cf08b9bcbb509e4c08f718
Instruction Fuzzy Hash: AE829C31B29A0D4BEBA9E76884657B9B2D2FFDC700F5545BAD01EC36D6CD38B8428341

Function 00007FFD9B891160 Relevance: 19.9, Strings: 15, Instructions: 1155COMMON

Download Yara Rule

Strings

8C;7, xrefs: 00007FFD9B89191D
+A;7, xrefs: 00007FFD9B891D40
WA;7, xrefs: 00007FFD9B891C0B
xB;7, xrefs: 00007FFD9B891A67
fC;7, xrefs: 00007FFD9B8918E1
uC;7, xrefs: 00007FFD9B8918A5
uC;7, xrefs: 00007FFD9B8918C3
SC;7, xrefs: 00007FFD9B891887
nA;7, xrefs: 00007FFD9B891C29
7C;7, xrefs: 00007FFD9B89193B
kB;7, xrefs: 00007FFD9B891AA3
8C;7, xrefs: 00007FFD9B8918FF
<B;7, xrefs: 00007FFD9B891AFD
xB;7, xrefs: 00007FFD9B891A85
%A;7, xrefs: 00007FFD9B891D9A

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID: %A;7$+A;7$7C;7$8C;7$8C;7$<B;7$SC;7$WA;7$fC;7$kB;7$nA;7$uC;7$uC;7$xB;7$xB;7
API String ID: 0-1664289608
Opcode ID: d57dbcb3e8a5870340de570154c660a3f32d19aaa84ecb9d32cb9ef25300596e
Instruction ID: c7c086ae24388811aec622040f426a7904e9f4b907e320359b0200bb829b5aa8
Opcode Fuzzy Hash: d57dbcb3e8a5870340de570154c660a3f32d19aaa84ecb9d32cb9ef25300596e
Instruction Fuzzy Hash: B382AD31B29A0D4BEBA9E76884657B9B2D2FFDC700F5544B9D01EC36D6CD38B8428741

Function 00007FFD9B897E78 Relevance: 10.3, Strings: 8, Instructions: 326COMMON

Download Yara Rule

Strings

9F;7, xrefs: 00007FFD9B89805E
SE;7, xrefs: 00007FFD9B8981B6
7^], xrefs: 00007FFD9B897ED4
fF;7, xrefs: 00007FFD9B89813A
AF;7, xrefs: 00007FFD9B897FB5
F;7, xrefs: 00007FFD9B897F50
fF;7, xrefs: 00007FFD9B897FE5
vF;7, xrefs: 00007FFD9B897FCD

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID: 7^]$9F;7$AF;7$SE;7$fF;7$fF;7$vF;7$F;7
API String ID: 0-1396017199
Opcode ID: 866643a363ce972980128c1674fac36a1f76d51b3bf9d6bd48d8033b85221d9f
Instruction ID: 931741246c73ed6fbf6b8005d7fc36ecbeb37913ed3f0f8ea9c9b740854bcc4c
Opcode Fuzzy Hash: 866643a363ce972980128c1674fac36a1f76d51b3bf9d6bd48d8033b85221d9f
Instruction Fuzzy Hash: DCA1A150B1DA4A0FEBA9EBBC58757B86AD1DF9D304F4540BAE01DC32EBDD18AD018352

Function 00007FFD9B891DFF Relevance: 1.8, Strings: 1, Instructions: 581COMMON

Download Yara Rule

Strings

@;7, xrefs: 00007FFD9B89210E

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID: @;7
API String ID: 0-3754608257
Opcode ID: e00ce3b567ef06d5ca58ee0e08d3205edc3e85f098ca00b7c43d19801dbd90c9
Instruction ID: fcf05b693f7ed21bb30307bc572a3a5d6da9020f292b671df75d30cd506efc85
Opcode Fuzzy Hash: e00ce3b567ef06d5ca58ee0e08d3205edc3e85f098ca00b7c43d19801dbd90c9
Instruction Fuzzy Hash: CB124D31719A498FEBA8EB68C065BA977D2FF9C301F514579E04EC73A2CE34E9428741

Function 00007FFD9B898495 Relevance: 1.4, Strings: 1, Instructions: 132COMMON

Download Yara Rule

Strings

*D;7, xrefs: 00007FFD9B89857F

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID: *D;7
API String ID: 0-492306285
Opcode ID: 6d0c8f189cb99ae78694a57fa411067cdb4807926c60d8d444ebd50f1ee06f21
Instruction ID: 8d49e5919b98a87866ad533233ab84d150dbb631028b6bcfbfd0aed24a7226a0
Opcode Fuzzy Hash: 6d0c8f189cb99ae78694a57fa411067cdb4807926c60d8d444ebd50f1ee06f21
Instruction Fuzzy Hash: 4131B321B1D91D1EDB69F7B854366FD7AD1EF8C314B4105BAE01EC32D7EE28AA024385

Function 00007FFD9B892CF8 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

nA;7, xrefs: 00007FFD9B895FA1

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID: nA;7
API String ID: 0-267055852
Opcode ID: f91add5a7be07514f48a0a51dca07c393e560121e631fc2410538079826f91af
Instruction ID: c85cfc2f99e1ed9e5dc37208864c3360543ac300fbd2a12f57ea7bd0897ac9e3
Opcode Fuzzy Hash: f91add5a7be07514f48a0a51dca07c393e560121e631fc2410538079826f91af
Instruction Fuzzy Hash: 48210720F1DA690FE7BDA77C04692B87AE1EF4D310F1506BAD49AC71E7DD189D828381

Function 00007FFD9B894C80 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65506172313cf791b2d8770ad265ee9d0c0bab6fec3c32afeb23d02aede546ac
Instruction ID: 57b5029aa0a2c2d3bdab9ef5e371309c9bc39f3c599ed572f1fa22aa1b35b4cb
Opcode Fuzzy Hash: 65506172313cf791b2d8770ad265ee9d0c0bab6fec3c32afeb23d02aede546ac
Instruction Fuzzy Hash: 56717430B1881D9FEB58DB58D8A4E7877E2FF98315B554179E00AD72DACE38AC42C750

Function 00007FFD9B895665 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4d7b6c75352e44c0b82488a054190e69aaaab9ab6e5f6f8807fb5ad7c7f1ebc
Instruction ID: b3ebcb8145876fbca6419758dffe740b1a962f19d6919a5ababed25043f2bf89
Opcode Fuzzy Hash: a4d7b6c75352e44c0b82488a054190e69aaaab9ab6e5f6f8807fb5ad7c7f1ebc
Instruction Fuzzy Hash: 37618E71619B8E8FDFA8CF58C8646A53BA1FF4D304F1506ADD46AC72E2CA35E912C740

Function 00007FFD9B892DF9 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 570f985621b2503dedc02f8ce8f5328df25a3cc089b199cd254b694ec0595457
Instruction ID: aad7ab3dcdc3001436925c8b8e6962d3997a0da50c811d564fcde3376a495a1f
Opcode Fuzzy Hash: 570f985621b2503dedc02f8ce8f5328df25a3cc089b199cd254b694ec0595457
Instruction Fuzzy Hash: F251C192A0D1B25AD31B77F87D399E92F50CF4623D70882F7D1DD8A0DBE8482087539A

Function 00007FFD9B892D40 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a89f4f69cadf2243ee78cd7b263388c2a8eb2fcceab7cdbd0433dfbd031993e
Instruction ID: 5432675773dd22bec679daae0b125a28b774b9706cad77c1999181bbaef93285
Opcode Fuzzy Hash: 3a89f4f69cadf2243ee78cd7b263388c2a8eb2fcceab7cdbd0433dfbd031993e
Instruction Fuzzy Hash: 6141C531B1A91E8FEBB89BAC94696757BD0EF58301B0A05BED40EC71B1DE19ED818340

Function 00007FFD9B893907 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b225b4a4133051153661ec90133e67c858901ea1a1167677f0d0dc0ced71c73
Instruction ID: 9397e3a820ae13c5fb601a1d76bfa4cf1e02ae51b4f6869d1bb57dc3fc673059
Opcode Fuzzy Hash: 5b225b4a4133051153661ec90133e67c858901ea1a1167677f0d0dc0ced71c73
Instruction Fuzzy Hash: 49415121B28D0D4FFB98EB688469B6D67D2FF98344F5141B8D01EC72DADE68AC468341

Function 00007FFD9B894910 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a8b9506e0837cdc545d8dde29a21c60baadd5fb9101aed92064b2b83a5c7e24
Instruction ID: e221bd4f125ff12638a1adb8f828ff8b3330be7f12ac9aebda2e43da306b8439
Opcode Fuzzy Hash: 2a8b9506e0837cdc545d8dde29a21c60baadd5fb9101aed92064b2b83a5c7e24
Instruction Fuzzy Hash: 2F416A22B6924A0FEB2C8FA498C54B137C1EB8A32971E41BDC59BC7263E96894434781

Function 00007FFD9B89391C Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1654a0dd264ca0e0d171e76ff9d288995d8475bbc7be20a4e8127ab6cfcc58be
Instruction ID: 6546e5a485a62cafd110ed31bcb9dc3d4d3c2f616bc8b4ab819f59f5c5acd5f1
Opcode Fuzzy Hash: 1654a0dd264ca0e0d171e76ff9d288995d8475bbc7be20a4e8127ab6cfcc58be
Instruction Fuzzy Hash: BF310D11B28A1D0FFB88FB288469B6E62D2FF88344F5141B4901EC32DFDD68AD469342

Function 00007FFD9B892ED3 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68b44b10745b65d860cda0fa2fd9ff42f2b6e6721632432dde53669e7d01e412
Instruction ID: 2118e9bebe26100d38299af83c1a7d90142e6c6a40efd73d2301d23b98881ede
Opcode Fuzzy Hash: 68b44b10745b65d860cda0fa2fd9ff42f2b6e6721632432dde53669e7d01e412
Instruction Fuzzy Hash: 693146A2B0E5A91AE70B37FCBC355E82B50DF8133930881F7C298CA59BEC08544B43D6

Function 00007FFD9B894A81 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40db0bec158405942ef8cb85b5699fb87b909a2b4d280a6c2c8e38989d23ab43
Instruction ID: 086da8963d8cf5569f5387f3e469a4cc844157788e3cd94b3895cb5fd626a95c
Opcode Fuzzy Hash: 40db0bec158405942ef8cb85b5699fb87b909a2b4d280a6c2c8e38989d23ab43
Instruction Fuzzy Hash: 79219631B1A95E8FEB78DB6894682757BE0FF1830174A05BED04FC75B2DE29A9418700

Function 00007FFD9B892D45 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b8b9859ba9d6a850d6b3c569883e4125177c01e3097810ab86d0bea9f233029
Instruction ID: 97fc1373587df89e596b1eadb28dc77c2c411e1b71b10b80b097ffa1d76b1f4f
Opcode Fuzzy Hash: 5b8b9859ba9d6a850d6b3c569883e4125177c01e3097810ab86d0bea9f233029
Instruction Fuzzy Hash: 09115B3272EE9C4FCB6ED77CC8297987BD0EF5D650B0801BED089C7192DD68A9068381

Function 00007FFD9B895FD9 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83cbb4df870b2a62808d50b178967ad33121c45f81417bd8b66d379f6f341ad7
Instruction ID: 9c527e0b76a1f02b0e639a6b4d9046dfcd920146a56aece432b62d13623a82c8
Opcode Fuzzy Hash: 83cbb4df870b2a62808d50b178967ad33121c45f81417bd8b66d379f6f341ad7
Instruction Fuzzy Hash: 3311296171DB494FD7A8E77C48A52743BD1EF9C250B4601BAE05DC32E3DF28AC069301

Function 00007FFD9B89085F Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ab6fa7230c000470b53943901a308a2a7d924b94e9a2f05a2298056e946ff68
Instruction ID: 299d43f2060785db082163837359d88a7be74e1142fdf88a83ef4f62a8a42d51
Opcode Fuzzy Hash: 1ab6fa7230c000470b53943901a308a2a7d924b94e9a2f05a2298056e946ff68
Instruction Fuzzy Hash: A911D602B1FAEA0EEB76637C1C711642EA19F5A910B0A02FBD0A9DB5E3DC086D454381

Function 00007FFD9B892491 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8a30b76b585b58532e8119b7c2575e75a22164ce1ae14a7fc954a45d533bf13
Instruction ID: 477c02b91077976099757488009e81b5d456c0e430597a16d178ec3c65d7444b
Opcode Fuzzy Hash: e8a30b76b585b58532e8119b7c2575e75a22164ce1ae14a7fc954a45d533bf13
Instruction Fuzzy Hash: 1A01C83270EE840BFBB99F7C68726A42FD2AF8A344F4905ADE09D832E3DC166501C305

Function 00007FFD9B89439A Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6edf7141b6c13dc83edc13b414ce6634ad895c3d72f1f95dc12d7fbb4ce22b27
Instruction ID: 4c688d815a17f639eabd45489de4df17cc7fb2243a5a335d1a36d64009458c19
Opcode Fuzzy Hash: 6edf7141b6c13dc83edc13b414ce6634ad895c3d72f1f95dc12d7fbb4ce22b27
Instruction Fuzzy Hash: AB01B120F1DA4A0BEB5DAF745865ABDBAE0EF44200F4400BDE44BC32DACE2CA4469645

Function 00007FFD9B89306D Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00f09396892c9c44861b9a0f05d1f9c43ebe6eea7861f820985654f973844ddb
Instruction ID: b32ddebafe5783952476dd53aba5412ea31dbc48e623c0beb738c4168fb9e9a5
Opcode Fuzzy Hash: 00f09396892c9c44861b9a0f05d1f9c43ebe6eea7861f820985654f973844ddb
Instruction Fuzzy Hash: E001F931B0968D4FDB55DFA4C8256F97FB1EF86310F0402AED046D7292DD296A058751

Function 00007FFD9B8943AD Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 997dfec116eff7f53e06f8d180ef52ecc1a5b1bcaf81e5b88843298827a2e393
Instruction ID: e211d5ae4e15862e60f7a10d23e283c85af5955ae065e2b2c0241f4f7fa4b851
Opcode Fuzzy Hash: 997dfec116eff7f53e06f8d180ef52ecc1a5b1bcaf81e5b88843298827a2e393
Instruction Fuzzy Hash: E3F04430F28A1A0BD75CEF68986567DB6E1FF48744F54407CE44ED32CACE2CE8864685

Function 00007FFD9B894869 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1420c2e7334924c0640e68592f3803c4c02b709b3b409891e457d5bd334512e
Instruction ID: 0d90b123dbbbe33f2d7be5ccd4d7d77fbbded712f5bee143bbbee53b444eef63
Opcode Fuzzy Hash: b1420c2e7334924c0640e68592f3803c4c02b709b3b409891e457d5bd334512e
Instruction Fuzzy Hash: 71F0FF3285E7C90FD352DBA0C8689A4BFE0FF9A200B0A41FED084C70A3EA6895468711

Function 00007FFD9B893BE6 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b2f90f4637e898bd728abf5d8701c90ce4ed60e1154c3a9d7f3ceb4601a2c8d
Instruction ID: 0598b7e51fec8a0fc0a0a410b05cd09e9b6289b143cbcd9d461eee7dcbf7936b
Opcode Fuzzy Hash: 3b2f90f4637e898bd728abf5d8701c90ce4ed60e1154c3a9d7f3ceb4601a2c8d
Instruction Fuzzy Hash: F5F04920B15E1E4EEBB8D76880A477565E1FF68304F5145B9D05BC31E5DD38AE85C740

Function 00007FFD9B893C22 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60348264345a278b3f3560ca821aebf2f51efc39a0badf163b9abbbe55d62040
Instruction ID: 71c1001e0ad2207bbc96c1c506fc74697515fdf47764484fd6f92eeecf9b3319
Opcode Fuzzy Hash: 60348264345a278b3f3560ca821aebf2f51efc39a0badf163b9abbbe55d62040
Instruction Fuzzy Hash: E2F03620B19E5A4FEBA497588064775A7E1EF64314F4446B5D04AC71A5CD34AA85C780

Function 00007FFD9B898607 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4340e385bed691319ac85626217e776987238578281a28496b96498fd116ef08
Instruction ID: 12ad625e6f17ded6361429f2e86191a7a8fea2879eb1a46ebb3c04a4a48996a1
Opcode Fuzzy Hash: 4340e385bed691319ac85626217e776987238578281a28496b96498fd116ef08
Instruction Fuzzy Hash: 75E0CD7214E50C1F561866567C0B8F73B5CEA8B239B00112FF44DC5002E15665738250

Function 00007FFD9B8908CD Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f4a97fac990d50725fe612af55ea86ba8fa47338b3f0343e0419334eecd7d0c
Instruction ID: 8abb9ee23e1b744b44b1ccc1b515b92e9a673a045b5fdc53a78af85bae5178bf
Opcode Fuzzy Hash: 3f4a97fac990d50725fe612af55ea86ba8fa47338b3f0343e0419334eecd7d0c
Instruction Fuzzy Hash: A0E0D862B6FBAD0FDBB5972C08751647E61AF0DA40B0605EBC048DB5E3F9059D0D83C2

Function 00007FFD9B8933B5 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66dfc3157e50b19072419f9e812b76a54bab15317e78086385feb7d85c0a7e6d
Instruction ID: 3e8e54c3a2acdc217b34b162ad55288d1b119315404aef6e066f066bb87e67f0
Opcode Fuzzy Hash: 66dfc3157e50b19072419f9e812b76a54bab15317e78086385feb7d85c0a7e6d
Instruction Fuzzy Hash: ADE07D3071F1190BDF01A7A470121E87BC0DF49310F0508B9D40CCB6E6C89E9AC34380

Function 00007FFD9B893BC0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7760dc228e6f6e78312676136aa00c85bbac142880d16222b7e32c346e71cd52
Instruction ID: d9d7b23609897dd661b0dd57f7d094e72292afe2c0c3aad59c7664c7b476b4a3
Opcode Fuzzy Hash: 7760dc228e6f6e78312676136aa00c85bbac142880d16222b7e32c346e71cd52
Instruction Fuzzy Hash: 75D0C929715E7A4AE69CDB68D0B027635E3FBD9309B91807DC98BD65E4CD3EA9408340

Function 00007FFD9B894A60 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b43bd80490eb3a3119b6abd425fe28c73738210e5f3cbe728c076d226774792
Instruction ID: 8665a04373f46054b60a6bb0c858871bb99b8ffdb615dc90b1d2ad364e82b701
Opcode Fuzzy Hash: 8b43bd80490eb3a3119b6abd425fe28c73738210e5f3cbe728c076d226774792
Instruction Fuzzy Hash: 43C04C14E6740E01ED7C37FA0D562A415C06B58615FC901B0EC18C51B1E94E56D94192

Function 00007FFD9B892D30 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73be16dc4baf608ab66abf638d75fcacf77cae45820e647161e3d459c11370b3
Instruction ID: b277204971d3b5d0bc827c688c728de336553d6599b2eb49f69f75f3de3b6945
Opcode Fuzzy Hash: 73be16dc4baf608ab66abf638d75fcacf77cae45820e647161e3d459c11370b3
Instruction Fuzzy Hash: 9BC01210E1A11E45EE7C36F529650F425C05F48218F4501F1D819850F6FD0C12850155

Non-executed Functions

Function 00007FFD9B89823D Relevance: 5.2, Strings: 4, Instructions: 151COMMON

Download Yara Rule

Strings

:E;7, xrefs: 00007FFD9B8982A6
FD;7, xrefs: 00007FFD9B8982BF
LR_H, xrefs: 00007FFD9B89836D
iE;7, xrefs: 00007FFD9B89824C

Memory Dump Source

Source File: 00000003.00000002.1762528423.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_Treatments?Secure.jbxd

Similarity

API ID:
String ID: :E;7$FD;7$LR_H$iE;7
API String ID: 0-832429719
Opcode ID: 1c08a9ed44efb3da1f6df3392485abda9ed9bd274762e8b3ff8eaf0ba9a9c38c
Instruction ID: 5bc0e0d531f94ce7c81cabeab3ece54eb8295bebdb3c021756c91c9eb160d1e0
Opcode Fuzzy Hash: 1c08a9ed44efb3da1f6df3392485abda9ed9bd274762e8b3ff8eaf0ba9a9c38c
Instruction Fuzzy Hash: C841D462B1994E0FDFA4FB6C94652B937D2EF9C344B45007AE44DC33A6DE28AD038341

Analysis Process: Treatments?Secure.exePID: 6612, Parent PID: 6580COMMON

Executed Functions

Function 00007FFD9B8A400E Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5203f80271e32ccf2c2399900f10db0bdd5761bdb720bb56f3f561f7b5b7a2a4
Instruction ID: 830de8f1e36469c0f4f002e40ea33525b6c2b9f3e76a8139443e4d776b94f663
Opcode Fuzzy Hash: 5203f80271e32ccf2c2399900f10db0bdd5761bdb720bb56f3f561f7b5b7a2a4
Instruction Fuzzy Hash: FFD16930E1965D4FDB6CDB9884A16B8B7E1FF45301F5881BDD09BC7296DE38A9838B40

Function 00007FFD9B8A306D Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d02b3010363392eab10bab4d247ad5de4e217f97e69b90bfaf2a24ab06450cd
Instruction ID: 51aed948579cc9dd7f26ed5533029aae866f5054259aa95f08c494eac013b0eb
Opcode Fuzzy Hash: 4d02b3010363392eab10bab4d247ad5de4e217f97e69b90bfaf2a24ab06450cd
Instruction Fuzzy Hash: D7A12C78E0850E8FEF58DBA9D465ABDBBB0FF58311F01216AD01AEB291DF356941CB10

Function 00007FFD9B8A3BF0 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 838d9faeb4105e3fd6c00c47049ad5d496b6ea007416f9be450775cb2835bf80
Instruction ID: 473176b3bc68861ec0ff8df5668a2ac9287d944a1b0996a8f985b34d44974f74
Opcode Fuzzy Hash: 838d9faeb4105e3fd6c00c47049ad5d496b6ea007416f9be450775cb2835bf80
Instruction Fuzzy Hash: 2791D130A1AA4D8FDB68DFA888756B9BBE1FF49300F4505BED04AD72A2DA346941C740

Function 00007FFD9B8A3C1B Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 290f5c16f7e535760516e3a43bbad5b461a4a6685161827be81eecfd758b8693
Instruction ID: aafeecb3485ec7c48bf2d397b0110abe7b9b7e4fbb838fdf01f16996ded57cb1
Opcode Fuzzy Hash: 290f5c16f7e535760516e3a43bbad5b461a4a6685161827be81eecfd758b8693
Instruction Fuzzy Hash: D5619131F19A0D8FDBA8DFA888616A8B7E1FF59314F0502BAD00ED72E2DB346941C744

Function 00007FFD9B8A1124 Relevance: 19.9, Strings: 15, Instructions: 1176COMMON

Download Yara Rule

Strings

fC;7, xrefs: 00007FFD9B8A18E1
+A;7, xrefs: 00007FFD9B8A1D40
8C;7, xrefs: 00007FFD9B8A191D
xB;7, xrefs: 00007FFD9B8A1A67
uC;7, xrefs: 00007FFD9B8A18C3
SC;7, xrefs: 00007FFD9B8A1887
kB;7, xrefs: 00007FFD9B8A1AA3
WA;7, xrefs: 00007FFD9B8A1C0B
xB;7, xrefs: 00007FFD9B8A1A85
uC;7, xrefs: 00007FFD9B8A18A5
<B;7, xrefs: 00007FFD9B8A1AFD
8C;7, xrefs: 00007FFD9B8A18FF
7C;7, xrefs: 00007FFD9B8A193B
nA;7, xrefs: 00007FFD9B8A1C29
%A;7, xrefs: 00007FFD9B8A1D9A

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID: %A;7$+A;7$7C;7$8C;7$8C;7$<B;7$SC;7$WA;7$fC;7$kB;7$nA;7$uC;7$uC;7$xB;7$xB;7
API String ID: 0-1664289608
Opcode ID: c5aac4ae1f95cbacbe0e3aecb0c4f2702d08efbbd80e66f3438b3abb22fc88ea
Instruction ID: b0aaab4d313d27038c0cc9440871398e31b94d7da4d6737866e55c8b5320701c
Opcode Fuzzy Hash: c5aac4ae1f95cbacbe0e3aecb0c4f2702d08efbbd80e66f3438b3abb22fc88ea
Instruction Fuzzy Hash: FF827C31B29A0D4BE7A9EB6884657B9B2D2FFDC301F5545BAD05EC32D6CD38B8428701

Function 00007FFD9B8A1160 Relevance: 19.9, Strings: 15, Instructions: 1155COMMON

Download Yara Rule

Strings

fC;7, xrefs: 00007FFD9B8A18E1
+A;7, xrefs: 00007FFD9B8A1D40
8C;7, xrefs: 00007FFD9B8A191D
xB;7, xrefs: 00007FFD9B8A1A67
uC;7, xrefs: 00007FFD9B8A18C3
SC;7, xrefs: 00007FFD9B8A1887
kB;7, xrefs: 00007FFD9B8A1AA3
WA;7, xrefs: 00007FFD9B8A1C0B
xB;7, xrefs: 00007FFD9B8A1A85
uC;7, xrefs: 00007FFD9B8A18A5
<B;7, xrefs: 00007FFD9B8A1AFD
8C;7, xrefs: 00007FFD9B8A18FF
7C;7, xrefs: 00007FFD9B8A193B
nA;7, xrefs: 00007FFD9B8A1C29
%A;7, xrefs: 00007FFD9B8A1D9A

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID: %A;7$+A;7$7C;7$8C;7$8C;7$<B;7$SC;7$WA;7$fC;7$kB;7$nA;7$uC;7$uC;7$xB;7$xB;7
API String ID: 0-1664289608
Opcode ID: eb6ec7d5ac7941931e0b2b70a02e18e04c4eada10288c2c6b7c3a8d656a83a6f
Instruction ID: 4bae366b7031cb7a56cbd099cc94a3e0c21581b23e4c5c811b2601aa08e45d58
Opcode Fuzzy Hash: eb6ec7d5ac7941931e0b2b70a02e18e04c4eada10288c2c6b7c3a8d656a83a6f
Instruction Fuzzy Hash: D6827C31B29A0D8BE7A9EB6884657B9B2D2FFDC301F5545B9D05EC32D6CD38B8428701

Function 00007FFD9B8A7E60 Relevance: 14.3, Strings: 11, Instructions: 538COMMON

Download Yara Rule

Strings

FD;7, xrefs: 00007FFD9B8A82BF
9F;7, xrefs: 00007FFD9B8A805E
iE;7, xrefs: 00007FFD9B8A824C
SE;7, xrefs: 00007FFD9B8A81B6
LQ_H, xrefs: 00007FFD9B8A836D
fF;7, xrefs: 00007FFD9B8A7FE5
AF;7, xrefs: 00007FFD9B8A7FB5
F;7, xrefs: 00007FFD9B8A7F50
fF;7, xrefs: 00007FFD9B8A813A
:E;7, xrefs: 00007FFD9B8A82A6
vF;7, xrefs: 00007FFD9B8A7FCD

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID: 9F;7$:E;7$AF;7$FD;7$LQ_H$SE;7$fF;7$fF;7$iE;7$vF;7$F;7
API String ID: 0-766849283
Opcode ID: 265046d72e2620afdde24ad5f7c008a0512105d8e08d8c4f96fdf9c0d0e1071d
Instruction ID: c93d69d3c86e73a8bdcda388571b3f217270b5d3b35f2d01400dd52453d65176
Opcode Fuzzy Hash: 265046d72e2620afdde24ad5f7c008a0512105d8e08d8c4f96fdf9c0d0e1071d
Instruction Fuzzy Hash: CEF1C460B1E94D0FEBA5FBBC48756B967D2EF8D204B4500BAD44EC72EBDD186D028361

Function 00007FFD9B8A7E73 Relevance: 5.2, Strings: 4, Instructions: 189COMMON

Download Yara Rule

Strings

fF;7, xrefs: 00007FFD9B8A7FE5
AF;7, xrefs: 00007FFD9B8A7FB5
F;7, xrefs: 00007FFD9B8A7F50
vF;7, xrefs: 00007FFD9B8A7FCD

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID: AF;7$fF;7$vF;7$F;7
API String ID: 0-1000327434
Opcode ID: bd7bafc449adf053d570e6fd64237fc7d37a60f635460fb405431aeab579879f
Instruction ID: cb8d48ff8e0a18dd4a3e7999cb38b18584ae150a9bc3cbfbaae88e6b37c9d379
Opcode Fuzzy Hash: bd7bafc449adf053d570e6fd64237fc7d37a60f635460fb405431aeab579879f
Instruction Fuzzy Hash: BE51E351F1E6590FE7A9FBBC68362F96BD1DF89214F4500BAD04DC31E7DD18680683A2

Function 00007FFD9B8A80B8 Relevance: 2.6, Strings: 2, Instructions: 122COMMON

Download Yara Rule

Strings

SE;7, xrefs: 00007FFD9B8A81B6
fF;7, xrefs: 00007FFD9B8A813A

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID: SE;7$fF;7
API String ID: 0-2779052407
Opcode ID: 7f4902e73ca0e51889e299f4da21c6239c585ed2d10d8b620ba329e640b3b368
Instruction ID: 897f104164388664992763bd0d6e38274f3332706d236eefe18ebfcd1ee65b15
Opcode Fuzzy Hash: 7f4902e73ca0e51889e299f4da21c6239c585ed2d10d8b620ba329e640b3b368
Instruction Fuzzy Hash: 3E313550F2D94D1FEBA9F7B814766BD56C2DF8D200B8544B9E40EC72DBDC189D028351

Function 00007FFD9B8A1DFF Relevance: 1.9, Strings: 1, Instructions: 691COMMON

Download Yara Rule

Strings

@;7, xrefs: 00007FFD9B8A210E

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID: @;7
API String ID: 0-3754608257
Opcode ID: 4295ba4fec67cd1e10125c7fbb8a1f6dfffb548d36d757cf7444d7e58bcc5ddf
Instruction ID: 287d5f2ca83d316d0427c26e213eee728e314523dd7072d94286cf9b892756ae
Opcode Fuzzy Hash: 4295ba4fec67cd1e10125c7fbb8a1f6dfffb548d36d757cf7444d7e58bcc5ddf
Instruction Fuzzy Hash: 61328E31719A498FE7A8EB68C465BA977D2FF9C300F1145BDE04EC72A2DE34E9428741

Function 00007FFD9B8A965E Relevance: 1.5, Strings: 1, Instructions: 284COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9B8A970D

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: ff6221afbec688708c8247e2e6c01152666920718e0132106edf2f1a6f5324b7
Instruction ID: 6b36aa524bcefb98ff9a86f0ae581c0354cf3fc8cb4c9f1071c739134b58e010
Opcode Fuzzy Hash: ff6221afbec688708c8247e2e6c01152666920718e0132106edf2f1a6f5324b7
Instruction Fuzzy Hash: D0715A3070D65C4FD768EB6C9859AB57BD1EF89320F1605BBE08DC31B2D919AD82C391

Function 00007FFD9B8A8495 Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

&D;7, xrefs: 00007FFD9B8A84C2

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID: &D;7
API String ID: 0-1468088533
Opcode ID: 5d7a3fe3c11440141334680304029657875dd0c7a9853e1fed3ec82c89e3b250
Instruction ID: 0eca408298983b0a1b87e221497d499fb0e20b99e1b39d7623279ecd2c771a62
Opcode Fuzzy Hash: 5d7a3fe3c11440141334680304029657875dd0c7a9853e1fed3ec82c89e3b250
Instruction Fuzzy Hash: 2841F751B1EA490FF6ADA76C58662BC67C1DFD9360B4602BEF44EC32E7DD186C034261

Function 00007FFD9B8A8D10 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

{., xrefs: 00007FFD9B8ACBB1

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID: {.
API String ID: 0-4096538990
Opcode ID: e054b30163fd0c06869ee85744b738fbdcc5e0c2d86da4dc10b6b3f6188290ea
Instruction ID: 1f627bfe15a4996ea13f0dfe92d8c72668879da1b9ddb97e19886f82f9d44d1f
Opcode Fuzzy Hash: e054b30163fd0c06869ee85744b738fbdcc5e0c2d86da4dc10b6b3f6188290ea
Instruction Fuzzy Hash: E3414F30B0DD0E4FEBA8F7AC9868A7563D1EF58310B550579D04EC32E6ED29F9828B51

Function 00007FFD9B8A2AFA Relevance: 1.4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

Strings

nA;7, xrefs: 00007FFD9B8A5FA1

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID: nA;7
API String ID: 0-267055852
Opcode ID: 9c44ded6b4bdfe081ee05376141f359c4b108149e63d95cbf4d4b458fda81274
Instruction ID: cabd8cbe908915e21350bca654c221330ddb3f2832d1d55fed65ed753cf624b5
Opcode Fuzzy Hash: 9c44ded6b4bdfe081ee05376141f359c4b108149e63d95cbf4d4b458fda81274
Instruction Fuzzy Hash: 0831C227709636CAD30ABB7CFDA64E87350EF4233970887B7D0C98A087AD29604687D5

Function 00007FFD9B8A2C18 Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

nA;7, xrefs: 00007FFD9B8A5FA1

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID: nA;7
API String ID: 0-267055852
Opcode ID: 86500c84e781c1e1eeafd990f6de0b5ea427d0d88058fc585cf3c3c07df3385c
Instruction ID: a11014814b6620af0354272a6356b3106f6ab3151f23b8fea20008c246327523
Opcode Fuzzy Hash: 86500c84e781c1e1eeafd990f6de0b5ea427d0d88058fc585cf3c3c07df3385c
Instruction Fuzzy Hash: B7317C22B0FA980FE73997AC59351F87B91EF4A310B0443FBD0898B0EBDC596D468351

Function 00007FFD9B8A81FB Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

iE;7, xrefs: 00007FFD9B8A824C

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID: iE;7
API String ID: 0-2503238281
Opcode ID: 2f1ee8d537f2ce2fdb7cc97659f7c46f037b9d8c81fcf0cc14548a04a3529fdb
Instruction ID: e02b4c8cbb47f1586ebf2a9df8153b5be2d60ce261341b40b30ef8b1dbefa10b
Opcode Fuzzy Hash: 2f1ee8d537f2ce2fdb7cc97659f7c46f037b9d8c81fcf0cc14548a04a3529fdb
Instruction Fuzzy Hash: 2611C431B2DA884FDB54FB6840657B97BD0EF4A209F4504B9E48EC72A3CE2499428351

Function 00007FFD9B8A33A0 Relevance: 1.3, Strings: 1, Instructions: 33COMMON

Download Yara Rule

Strings

3*, xrefs: 00007FFD9B8A33DF

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID: 3*
API String ID: 0-3420534906
Opcode ID: 573ec1ec57f3ce44a7b053a1cbd9100524861e267a7bff4e5becec046e8d5688
Instruction ID: 1a7239c650029e9c59d8f11cdef953b7635d521b1a3dd6ed1fcb29b620fde2f7
Opcode Fuzzy Hash: 573ec1ec57f3ce44a7b053a1cbd9100524861e267a7bff4e5becec046e8d5688
Instruction Fuzzy Hash: 3AF0E530A2A9180BD754B7B864226E977D0DF49314F0508BAD84CDB2B5D8999DC34381

Function 00007FFD9B8A9AF8 Relevance: .6, Instructions: 614COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aa89b1a3cda51ad5071e71e0f405a5c4fa16f18eb7d9c8af1d7dca977e66c30
Instruction ID: 9130bff3ba37a85720eadb4d5fad3c1913168285a57143df429afbafaf5810cb
Opcode Fuzzy Hash: 9aa89b1a3cda51ad5071e71e0f405a5c4fa16f18eb7d9c8af1d7dca977e66c30
Instruction Fuzzy Hash: 93222834608A4D8FDF98EF5CC898AA977E1FF6C301B0501A9E85ED72A1DA35EC41CB40

Function 00007FFD9B8A9B50 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c601eb5197df3b20779b3fa9fbcdb05e92a83dbae8b347636743fea1543f1275
Instruction ID: d71363b6742a66f809dbd1757b62aee4526c5df64b7dc24378f4518f124f5b58
Opcode Fuzzy Hash: c601eb5197df3b20779b3fa9fbcdb05e92a83dbae8b347636743fea1543f1275
Instruction Fuzzy Hash: 2FB17B31E0E68D4FE7749BA898652B87BD4EF0E350F0501BED08D871B3EE2869468761

Function 00007FFD9B8A4BB8 Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 086b517070bed61c9219c4628e2ad33262ef1263b32b53691fbdbd4387a5a421
Instruction ID: 2ca2eed1f0d89c4cdfb26103d406109b1f502d234063cd50d1665a0a8c8dacef
Opcode Fuzzy Hash: 086b517070bed61c9219c4628e2ad33262ef1263b32b53691fbdbd4387a5a421
Instruction Fuzzy Hash: 01B1C730B1991D4FDB54EB98D864AB977E2FF98310B550179E00ED72E6CE38AC42C750

Function 00007FFD9B8AAB95 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de62b0c49b9dfd03fa6490a7ad252de02935bc28fce46efe1a98a981957c5c11
Instruction ID: 44e40e7466e1ac1874eaffc0e5753c10fb4c1babd8ed17e6ccc01092a58735d1
Opcode Fuzzy Hash: de62b0c49b9dfd03fa6490a7ad252de02935bc28fce46efe1a98a981957c5c11
Instruction Fuzzy Hash: 71A14831B0EA8D4FD756E76898656B837A0EF89310F0500FBD08DC71E7DE2869438392

Function 00007FFD9B8A4F51 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bce9c25cb37fea8e15e6192b3a88e92541d198c8efee75568f4521f860b9c52
Instruction ID: 3d0f607e18f8e84aabe033a118bdfec68a3aba72eca4092cb52aa75eef8377ef
Opcode Fuzzy Hash: 1bce9c25cb37fea8e15e6192b3a88e92541d198c8efee75568f4521f860b9c52
Instruction Fuzzy Hash: F871B331B5E6890FD76D9BBC58644B13BD0EF8A21571E41BDD88ACB1A3DD18EC438391

Function 00007FFD9B8A92ED Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4082731bc4672f8e028a28aad1d537d833d385104bff7f817237a89bdce8b8c
Instruction ID: 48ba4d9cd76fb2d7617a68c65bbc4a87f1c12722623172022b1e6ec310e96ef2
Opcode Fuzzy Hash: e4082731bc4672f8e028a28aad1d537d833d385104bff7f817237a89bdce8b8c
Instruction Fuzzy Hash: BE81A221F0DD1E4FEBA4E7A888296BD63D2FF98350B810575D05EC32E6DE28AD428351

Function 00007FFD9B8A2DF9 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0693895a70b647d83ca5c7c4574c2c2db63c35ecc8493d5c39d6fde1775f97dd
Instruction ID: 2bbb266be908d860ed7466dbf92ab5aa4ee83fd2296a0d51838abda1f8b35573
Opcode Fuzzy Hash: 0693895a70b647d83ca5c7c4574c2c2db63c35ecc8493d5c39d6fde1775f97dd
Instruction Fuzzy Hash: 2F71155270D5A59ED31B77B878399E93B90CF4623970882F7D0DDCA0D7EC5824878395

Function 00007FFD9B8A9EB4 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a791d2134a1bdf97b586e18fe8d07f449ca5ec3572eac45d694ae3956e96f43b
Instruction ID: cd2c6290d29402d3e36d19e4c9e36ce53b6cd498ae5511f40e8cbef321fe266b
Opcode Fuzzy Hash: a791d2134a1bdf97b586e18fe8d07f449ca5ec3572eac45d694ae3956e96f43b
Instruction Fuzzy Hash: 7961E421F1EA0E4BEFA9ABB848756BC62D2EF9C344F454479D05EC32D7DD2CA9024711

Function 00007FFD9B8A0720 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f8c76e3b53aed8c33a5ba79f94a0fb5a78e2a3e9fcc015845f921b5f8a474a2
Instruction ID: 6560ede806de6a7812eeda620c4884378f9d101aed095778fd2ca23a681312a7
Opcode Fuzzy Hash: 0f8c76e3b53aed8c33a5ba79f94a0fb5a78e2a3e9fcc015845f921b5f8a474a2
Instruction Fuzzy Hash: A5514753B1FADA4EE33653B81C354A47B50EF55654B0A02FBC0AD8B0E3DC19790A8791

Function 00007FFD9B8A5665 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f78f3ff8b96d5afe14e80c20c5ddedc408caf0449883f0fef3fb18d8d1297b4
Instruction ID: 8ac9470eb6b06779f2a49ebafdbac840357f165cccdca29641100e467b5a9293
Opcode Fuzzy Hash: 7f78f3ff8b96d5afe14e80c20c5ddedc408caf0449883f0fef3fb18d8d1297b4
Instruction Fuzzy Hash: C861B171609B8E8FDB98CF58C8606A677A1FF5C304F1506ADE46EC72E2CA35E942C750

Function 00007FFD9B8A8D58 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d71816ed0f1a59d983c27d67ded7b48e803999e3474fd0a03ae9753cb321318
Instruction ID: 4da8fb28742b5ddba9d3781c2281d49db8c4ab19e6c702f67cb223f79f824ef6
Opcode Fuzzy Hash: 5d71816ed0f1a59d983c27d67ded7b48e803999e3474fd0a03ae9753cb321318
Instruction Fuzzy Hash: D9514921B0EA0D0FE7A9A7784C695B53BC5DF9D250B0A00BBE44DC32F2ED19AD428761

Function 00007FFD9B8A9895 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56064f5491bde5273b982ad6c36ef68aa4c0174ebf03b2ac39e2927fe5034579
Instruction ID: 8ed699900ec8686533d362049cb5d5b0b4bb789df4b4a9883a30787d6b135f40
Opcode Fuzzy Hash: 56064f5491bde5273b982ad6c36ef68aa4c0174ebf03b2ac39e2927fe5034579
Instruction Fuzzy Hash: 1651D93070EA494FD7A4DF6CD868A657BE0FF4931170A04BAE48DC7272DA24EC81C791

Function 00007FFD9B8A38D2 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0a7747ebea1cb54c36338439706b0917b31dc63abc4ab83fcdee25d7f0b3892
Instruction ID: e2f4404125951270535d35feeac83cb2b860d553a1bc3cb56f10166517c1fefd
Opcode Fuzzy Hash: e0a7747ebea1cb54c36338439706b0917b31dc63abc4ab83fcdee25d7f0b3892
Instruction Fuzzy Hash: F1517121B28E1D0FFB98EB6C8469B6D63D2FF98344F5140B5D01EC72DADE68AD468341

Function 00007FFD9B8ACC60 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9be9dbbce76e3b74867bd260c1f0f9682bc99ce66385624e915fade1d417fdd
Instruction ID: 83647d941910a447cb1ea840e2a8dea0904eb19f7aa52940a2a2226c8eb1dbf5
Opcode Fuzzy Hash: c9be9dbbce76e3b74867bd260c1f0f9682bc99ce66385624e915fade1d417fdd
Instruction Fuzzy Hash: C441E73131581C8FDAE4EB5CE898EA977E1FF6C31271605E6E44ACB271DA26DC81CB40

Function 00007FFD9B8A8C10 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b566f676e2d9dff928c8b5eab2da2042caae6c0dcd729314d447a19c4acee969
Instruction ID: e875243877898c5e898d92069783643ae06812dedeae6ffcc3997d344865419c
Opcode Fuzzy Hash: b566f676e2d9dff928c8b5eab2da2042caae6c0dcd729314d447a19c4acee969
Instruction Fuzzy Hash: BB512730A19E4A5BD75CEB68C8595B6B7E1FF98300F00423ED49AC36A1EB34B156CBD1

Function 00007FFD9B8A7DB8 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d826448b027f2e409cf16e93b566c3a4859309e43d93436f03bda4d02b67000
Instruction ID: fa4d4d508aa64bd66d2e796502ec24b7e7420b9865bbf6dcd02689e9c4b09c76
Opcode Fuzzy Hash: 2d826448b027f2e409cf16e93b566c3a4859309e43d93436f03bda4d02b67000
Instruction Fuzzy Hash: 0E41B031B0990E8FEBA8DB5C98293B977D5FF98350F01017AE41ED32D1DE2869418B90

Function 00007FFD9B8A2D40 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41edc0c6344fd743d742d077977a9f1216a9dde4678da2ac2e4c962e72e7be13
Instruction ID: 3f91f7f1e80f0157190a2bcd889581cef4fbdba7d306317884a0caedab2699a5
Opcode Fuzzy Hash: 41edc0c6344fd743d742d077977a9f1216a9dde4678da2ac2e4c962e72e7be13
Instruction Fuzzy Hash: 3641C331B1A91E4FEBB49BAC946967573D0EF58301B0A05BED44EC71F2DE19ED828350

Function 00007FFD9B8A4910 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eba65398e6857f40ac0e1886ea68f31c1ff446769c3573a9a93429692bcf98ae
Instruction ID: 9f479732cfd6ea251e0440acbdec5a848e20392ade1f55ff1ca4e8ba87a04437
Opcode Fuzzy Hash: eba65398e6857f40ac0e1886ea68f31c1ff446769c3573a9a93429692bcf98ae
Instruction Fuzzy Hash: 97417D32B6934A0FEB2C8FA498C54B177C1EB8A32971E417DC59BC7163E968A4434781

Function 00007FFD9B8A2ED3 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24773d10f16eb36124d3bc3d7a8930b1d517e586ba9ee68e2148bbd0b276552f
Instruction ID: 208284287f11ed9eac40b37b45b09d23487fef3d6bd3b5fe6f8da500840029e4
Opcode Fuzzy Hash: 24773d10f16eb36124d3bc3d7a8930b1d517e586ba9ee68e2148bbd0b276552f
Instruction Fuzzy Hash: 88419A6270E9699FD71677BCB8256E83790DF8532570842FBC08DC71CBEC1854478390

Function 00007FFD9B8AC19F Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 936c931d41ee0efb425a640a7ef31124d8042aeba3e06560f8a70b1ab322fcaf
Instruction ID: d306a610b4c71bbe5606b06fabb8c4c0d944acd4f857cc5aaeb3435485542b0a
Opcode Fuzzy Hash: 936c931d41ee0efb425a640a7ef31124d8042aeba3e06560f8a70b1ab322fcaf
Instruction Fuzzy Hash: BD511A30A09E4A5FD369DB7884655A1BBE0FF58310B00437EC49AC35A1EB38B556C7D1

Function 00007FFD9B8A9EDF Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dba2217e2f99939380458900c18bd79441fd1f8c16f927e64d5aa9b607e8a55
Instruction ID: 13e01a4d12ef513e2f3785409b6e0edfb16b0d2ae29dcd15371688fc776783fe
Opcode Fuzzy Hash: 3dba2217e2f99939380458900c18bd79441fd1f8c16f927e64d5aa9b607e8a55
Instruction Fuzzy Hash: CB310921F1E90E5AFFA9A7A888757BC62D2EF9C304F06447DD04EC32E7DD2CA9418211

Function 00007FFD9B8A8C98 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e28b93098e9288d244f1dd36ff3e4bf4bea4e7b511f95df4c3684a80725eca5
Instruction ID: 83d41c5259dc64c83553772008a7edad70bc18dc50347e228908c7c6777cfd86
Opcode Fuzzy Hash: 5e28b93098e9288d244f1dd36ff3e4bf4bea4e7b511f95df4c3684a80725eca5
Instruction Fuzzy Hash: 6A31C230B0D80D4FDBA8D76CC868B7577D1EF99300B1541BAD04ECB2A2DA28AD92CB50

Function 00007FFD9B8A7DA0 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b86eb39925b7629a69c3e29dd496c303a21dc22861429b6215283179cd6dd0b
Instruction ID: fbc101fb0cf1f8faa89953a69c5f2c323798e39ef767be281ec9db84dd46d831
Opcode Fuzzy Hash: 5b86eb39925b7629a69c3e29dd496c303a21dc22861429b6215283179cd6dd0b
Instruction Fuzzy Hash: 4C31D831B0950E8BEBA4EF9C98297F977D5EF8C310F01013AE40DD32E5DE6869418AD0

Function 00007FFD9B8A391C Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fc32e0e6a8df9ade9f98656b2f3db2373be243db54dbf7efc633073adcf3221
Instruction ID: c8d1196c3c8bc1ac0bd8500a08d324d41cf2eaf860e32e4c24770ee42665459e
Opcode Fuzzy Hash: 3fc32e0e6a8df9ade9f98656b2f3db2373be243db54dbf7efc633073adcf3221
Instruction Fuzzy Hash: 76310F11B28A1D0FFB88FB288469B6D62D2FF88344F5140B4901EC32DFDD68AD469342

Function 00007FFD9B8AC6D9 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e057b04c4ddc94fbc724a083567804793af1a71db10dcac964400fadc0dd96d5
Instruction ID: 1e804afe65f6a29ebd2f76d950caf650ef3f720985e39df8c049805a6b6c55b6
Opcode Fuzzy Hash: e057b04c4ddc94fbc724a083567804793af1a71db10dcac964400fadc0dd96d5
Instruction Fuzzy Hash: 7331C431A0E64D8FEBA4DB9C98293A977E5EF48310F05017AE01DD32E2DE2869458B91

Function 00007FFD9B8AB81C Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f02bd52b03388da94e7d0cd0594f504f832eaced56bbade3734c373456b51c9
Instruction ID: d3f2b1ad76772503def73e8e3926109797ddfb560c1b2a611b94bb5a69ba551c
Opcode Fuzzy Hash: 0f02bd52b03388da94e7d0cd0594f504f832eaced56bbade3734c373456b51c9
Instruction Fuzzy Hash: 22312B76E0F68D09F77496A968621F8B7C8EF4D230F09027DD4DE478B3F515260B4255

Function 00007FFD9B8AB7F1 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f672e326b5cd57621a5d79608f3dd4a1e3cc791a288536d4df0e98b1b29c43b0
Instruction ID: dffc6f23ec1f0e7a44eff8ea0b400f424e1b55f314c22d5451ee092ab3a6966b
Opcode Fuzzy Hash: f672e326b5cd57621a5d79608f3dd4a1e3cc791a288536d4df0e98b1b29c43b0
Instruction Fuzzy Hash: F4215675A0F68D0AF37896989C662F87BC8EF4A220F09017DE49E438A3F915361B8161

Function 00007FFD9B8A4A81 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 661170d083583cf581ffb76d4ba591e9d668b88384b74cddd20741f6944b701a
Instruction ID: 1ba088eadc79224f32fba5ee484dd4b5cf60e8dfbb22f76267322544c7587db6
Opcode Fuzzy Hash: 661170d083583cf581ffb76d4ba591e9d668b88384b74cddd20741f6944b701a
Instruction Fuzzy Hash: F321A531B19A4A4FEB78DB6C946827577E0EF4830174905BED04AC75E2DA29A9428750

Function 00007FFD9B8AB8D3 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d36d96bc41f0b205fbf1492682cf090b8ebf5abd35864d45c0cd2120117b5939
Instruction ID: b8bbfee1f7335365e25c3006fc495e7130ac82bf06bd8bfa1ea43c161207f163
Opcode Fuzzy Hash: d36d96bc41f0b205fbf1492682cf090b8ebf5abd35864d45c0cd2120117b5939
Instruction Fuzzy Hash: 0F212C7150E6C91FE76697689C965B17FA4EF07220B0901EEE0C9C71B3F556A842C351

Function 00007FFD9B8A07FF Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1acf05f5933b377e1a969a0c3df5a4e0a36de4c55f39359729431746c5f07b9
Instruction ID: d67dddd60ba7e7ef470e627654be282c66aa0ac6f29170f66280cd2f591a7953
Opcode Fuzzy Hash: e1acf05f5933b377e1a969a0c3df5a4e0a36de4c55f39359729431746c5f07b9
Instruction Fuzzy Hash: A6214C13F0FADA0EE36663B82C711E57B60EF45624B0D02FBD0ECCA1E3D90869468395

Function 00007FFD9B8ABB61 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38fd69b16f2088801dcd546e002a131e3d2cdb97c7758fa770bd85c48838d998
Instruction ID: ccf6dd0337d14e75208444b25fc0149af3471c9eb90c7316d8ad9912df0534cc
Opcode Fuzzy Hash: 38fd69b16f2088801dcd546e002a131e3d2cdb97c7758fa770bd85c48838d998
Instruction Fuzzy Hash: 95218E30619E4C8FCBA8EB6CC59896573E2FF5D31134505ADD08AC7AA2DA24FC42C740

Function 00007FFD9B8ACFDC Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dce85f4a5745bdcfb1428ea1c85cf1df8ccced7fc320c67ca34df60cfca2e259
Instruction ID: e0fd69425b19c7f813a301d556f908a79d115f1ce500fa3c4aea3cb0826f9401
Opcode Fuzzy Hash: dce85f4a5745bdcfb1428ea1c85cf1df8ccced7fc320c67ca34df60cfca2e259
Instruction Fuzzy Hash: 31217130619E8D8FDBA5EB68C464F553BE0FF29300F4600E9D449CB2B2D628EC85CB51

Function 00007FFD9B8A0818 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91717ea3384c82023861010056827e6fbe37d543cb2b1f7c6fdca9a8e406f7b0
Instruction ID: 8566d679b58ca7733ac9e1a4faee8b0c5492af36e27c52479873002d2f45188d
Opcode Fuzzy Hash: 91717ea3384c82023861010056827e6fbe37d543cb2b1f7c6fdca9a8e406f7b0
Instruction Fuzzy Hash: DD212903B0FADA0EE76623B82C751E57F50AF56520B0A42FBD0ECCA1E7D90869068395

Function 00007FFD9B8AA1C2 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f9ce47b133a706b6ffb8aefdea3f33fc5bae1a9655ebcb5b7d57233f4b84039
Instruction ID: b96cfca91c77087c55310b3e480ed7219b2f9b51b75162be7a148b2bfa8a670b
Opcode Fuzzy Hash: 3f9ce47b133a706b6ffb8aefdea3f33fc5bae1a9655ebcb5b7d57233f4b84039
Instruction Fuzzy Hash: 9D210650A1FACA2EE753ABB848795F97FE0EF46110B4905FBD099CB0F7D918154AC312

Function 00007FFD9B8A2D45 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19fcaa9c67d6f49316808de26cbcef4041b135082f3623eebeb07adc0d447ef2
Instruction ID: dfe2313ab0191fe2b4a68ace938c2b4e8b1e2b0f664d78681b6125c0090df7bc
Opcode Fuzzy Hash: 19fcaa9c67d6f49316808de26cbcef4041b135082f3623eebeb07adc0d447ef2
Instruction Fuzzy Hash: 62115B3272EE9C4FC76AD77C88296987BD0EF5C250B0801BEE089C7192CE6899058391

Function 00007FFD9B8A8635 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef7c1231b0e7c118a4ac2bb5f4f30c5d5f8d482a14d72012ab7f4152eeb6870c
Instruction ID: c5aa087fac41f502432634a6e69e333c7046f8a92c1c3bd304a7edb0f310d9db
Opcode Fuzzy Hash: ef7c1231b0e7c118a4ac2bb5f4f30c5d5f8d482a14d72012ab7f4152eeb6870c
Instruction Fuzzy Hash: 36115B25B0F98E4FEBA6977898291F97B91EF8D220B4501B7D05DC20D2DE181E024371

Function 00007FFD9B8A5FD9 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4066dec4c3003f7834423604ce73cdd74113ff268d614c911f264412c3ade1b
Instruction ID: f9ccbc1c52d0c1b0f0b7ec20efd26ac9dc5e71e35ca719b4db8581fac6941ff4
Opcode Fuzzy Hash: f4066dec4c3003f7834423604ce73cdd74113ff268d614c911f264412c3ade1b
Instruction Fuzzy Hash: 4111066271DE4A0FD7A8E77C44A527577D1FFAD210B4602BAE05DC72E7DE28AC068311

Function 00007FFD9B8A43AD Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a1b72e73ac81e649a92ece0b96c995b7bfd489c6b456134e193e5705f874423
Instruction ID: 254d959be644d8c4bb57513d0cbb7d3cf2cfafc05105f496d50ac4d1cb4feeb4
Opcode Fuzzy Hash: 7a1b72e73ac81e649a92ece0b96c995b7bfd489c6b456134e193e5705f874423
Instruction Fuzzy Hash: 89217830B2EA890FD749DBB858756BDBBE0FF45204B4404FED48AC72E7CD1858468745

Function 00007FFD9B8AC898 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13d1d6ab5fdfcc83600e9088e81b139d64b3d6d7543a83491c4289a3ecdbc8f5
Instruction ID: 1786026e568d3ac9baf874d63fe08230c611e76dfa9533d068f405a49658ad9b
Opcode Fuzzy Hash: 13d1d6ab5fdfcc83600e9088e81b139d64b3d6d7543a83491c4289a3ecdbc8f5
Instruction Fuzzy Hash: C111C031A0FA8D1FD731A7648C608EA7FA9EF45310B0901BFD04DC72E2D9596A43C7A0

Function 00007FFD9B8ACDA2 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 007157cc34d5ac606268780ab3c5c21d771683285eb5d5ed7afd44c45a5a3ed9
Instruction ID: f9fdd7faf05d40a8ab6df120a77349c3531f768982b75e17a10670af684e3b4f
Opcode Fuzzy Hash: 007157cc34d5ac606268780ab3c5c21d771683285eb5d5ed7afd44c45a5a3ed9
Instruction Fuzzy Hash: 9D21663060DA8D4FDB95DB28C864F617BE5EF5A304F1944EAD04DCB2A3DA25EC91CB50

Function 00007FFD9B8A8796 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2fadc0d58eb552365130ab1be1c5b9f47e9ce925a3055d60ef5d9621a271806
Instruction ID: a00ba03ec50a30947029bcfcdcd12554d2cfaeb8ba4323f485d55116d2cfcb1a
Opcode Fuzzy Hash: f2fadc0d58eb552365130ab1be1c5b9f47e9ce925a3055d60ef5d9621a271806
Instruction Fuzzy Hash: C50152B2F1D60C4BE76C9B5C78131B973D2E788621F41023FE18ED3292DE6669134596

Function 00007FFD9B8A8782 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b12a8b218640a9ca0e2431f5bc1cefc945179996b2e98abbfd365c7c507ca895
Instruction ID: 69e0e5662e9adff26760f3e3a5a0ec8a831cdd750df1fffbe69a0e87b4071027
Opcode Fuzzy Hash: b12a8b218640a9ca0e2431f5bc1cefc945179996b2e98abbfd365c7c507ca895
Instruction Fuzzy Hash: 67019EB2F1D60C4BE76C9B4C78122B873D2E78C620F40023FE58ED3292DE666943459A

Function 00007FFD9B8A87A7 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57f819ffbffa1facf108b6440ec66a34a5380e00e04763c59e3644bbfa50b166
Instruction ID: a8880dad2d5cd8b499a025c0b0e6a72d42ea509079c3661e896f59e35b534093
Opcode Fuzzy Hash: 57f819ffbffa1facf108b6440ec66a34a5380e00e04763c59e3644bbfa50b166
Instruction Fuzzy Hash: 730171B2F1D60C4BE76C9B5C78131B873D2E7C8621F41023FE19ED3292DE666913459A

Function 00007FFD9B8A8C68 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d9dce402380ff87133189d60f24aa3a20368052eadc9403b7a4c00d10b752f5
Instruction ID: 4f310f587649c23abe6f880e23b93a629a4a0997f99268ea9c042458db35d596
Opcode Fuzzy Hash: 9d9dce402380ff87133189d60f24aa3a20368052eadc9403b7a4c00d10b752f5
Instruction Fuzzy Hash: 10114822F1E88D0FEBB8E77C98696A43BD1EF4C350F0100FAE05DC71A2D9986C464791

Function 00007FFD9B8AC43D Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8b6976152989a54c4ce2805033db5294208d356e05cec0e4654bcc550f25a6c
Instruction ID: ff9b55a9abcc1dd7002c6fa30d40c08e0b0748ceed961a32a1d124a7e1cd736a
Opcode Fuzzy Hash: d8b6976152989a54c4ce2805033db5294208d356e05cec0e4654bcc550f25a6c
Instruction Fuzzy Hash: 8111A921A0FB4E4FD7A5D76C9835A6837A5EF5921075741F6C00DCB1A3DA1DEC028711

Function 00007FFD9B8AA475 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2428ee5b170fc688f385955b5e1aa1bcbb054e1583d7d90c91f9fd692dac62f3
Instruction ID: f3f5c49b9df9194a1a70e92e8aa0d5b6d48262ccc544b62d266693a6ed926578
Opcode Fuzzy Hash: 2428ee5b170fc688f385955b5e1aa1bcbb054e1583d7d90c91f9fd692dac62f3
Instruction Fuzzy Hash: C401D821B1FA891FD755A7FD187A5B9BFD0EF8D20474904FAD089CB2ABD9285C42C341

Function 00007FFD9B8A8CB8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07684b19eaba63a6c865f328d6104988d61972d3f2357368607c19f1c92eefcd
Instruction ID: 2f2125ef76e333c401ebec7b7d24b2ab23baf2e53fe3abcaec0050839a98aed9
Opcode Fuzzy Hash: 07684b19eaba63a6c865f328d6104988d61972d3f2357368607c19f1c92eefcd
Instruction Fuzzy Hash: BA018421B1EC0E0EDBA4E76C5834B3962D9EF9C354B674079D40DC3199DD29EC418B55

Function 00007FFD9B8A4869 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b66d1c917028842f0487871d02ad9c2a4af38041fc29dbfa5a289db9e37e3ad4
Instruction ID: 94697d1dcf7a85086cf1a61b97041cc054c5a516dbb642374080827bfc48683f
Opcode Fuzzy Hash: b66d1c917028842f0487871d02ad9c2a4af38041fc29dbfa5a289db9e37e3ad4
Instruction Fuzzy Hash: 2601283144E6C91FC312DBA488659E5BFE0EF8A200B0A05FAD098CB0A3DA5855068311

Function 00007FFD9B8AC85B Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de0a3ffd5d13d6767177dca4cbb804e3130c36ae49ededd57900b94b49029f72
Instruction ID: a672e64ffb6b45396b2578bf60fbe3d0ed16da0f69b1699c560ac0f45a72e5d0
Opcode Fuzzy Hash: de0a3ffd5d13d6767177dca4cbb804e3130c36ae49ededd57900b94b49029f72
Instruction Fuzzy Hash: 4EF04C33A1E94C1BEB50569CEC244D8BFA5FFC8394F06057AF41CC72E1E66A5941C711

Function 00007FFD9B8AA40D Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1ff4b0a3b8d83671bfcf404393b1cdf8f754be5a62270d21b20854a7bfe5ef4
Instruction ID: d0cda00eef4dd196031221b21526d38902a18c83fe6f42c4f15d02da24f949cb
Opcode Fuzzy Hash: e1ff4b0a3b8d83671bfcf404393b1cdf8f754be5a62270d21b20854a7bfe5ef4
Instruction Fuzzy Hash: 05F0C23210D7885FC741D754C891996BBE0EF89310F494AAAF046C71A1DA24FA45CB82

Function 00007FFD9B8ACF38 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03f97c5a0737736a2bdf42e4dedb07fcab3dfe9ca3edaf915dd2c974c9a16980
Instruction ID: 8b864f1a2c928aeade442dc26c3dd70a7e36406c0c3eb6632f0eff21f2cb26fb
Opcode Fuzzy Hash: 03f97c5a0737736a2bdf42e4dedb07fcab3dfe9ca3edaf915dd2c974c9a16980
Instruction Fuzzy Hash: 13E0DF3271E8694FDAB4EB2C88646543AE0FF5CB80B0145EAE089C72A1D6909C048781

Function 00007FFD9B8A08CD Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 755825cd7c077250212eaeaae24560240148ed10ddcc6f4cf13f1266fee121c9
Instruction ID: 6de2b3481f57c22fd9cdc0953cc43a1fc681b2fcdb650dcd52af897c9604e6d5
Opcode Fuzzy Hash: 755825cd7c077250212eaeaae24560240148ed10ddcc6f4cf13f1266fee121c9
Instruction Fuzzy Hash: 6FE0D852A5FB9D0FD775972C08711547EA1AF4DA40B0A05EBC08CDB1E3F9445D0C43D2

Function 00007FFD9B8A9142 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fb0d4abe135b24da40cda8892483cc7731209ca88cb6b792d5f0b11e6ca0765
Instruction ID: 8b7fd8249b2aa7174da727e2e262b39e46bd7191e4654489d7a764b6eb38e7d0
Opcode Fuzzy Hash: 4fb0d4abe135b24da40cda8892483cc7731209ca88cb6b792d5f0b11e6ca0765
Instruction Fuzzy Hash: 17D0233370D72C0DFB1D1245BC131FC3740D6871707010177D69F85093A506312341D5

Function 00007FFD9B8AAB6A Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7959127c84c18e05c77ae2a0d2a93ade472a0e3aca7ce600ec1764fb53904667
Instruction ID: 4935e70cce2d1cb7c31d1329dfde5a96c090d43cc04a378dcbcc61c33d638122
Opcode Fuzzy Hash: 7959127c84c18e05c77ae2a0d2a93ade472a0e3aca7ce600ec1764fb53904667
Instruction Fuzzy Hash: D4D05B20B19B591BFAB5939D90517B976C15F4D760F01042DE089816E1CA5C69C1C391

Function 00007FFD9B8A4A60 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b43bd80490eb3a3119b6abd425fe28c73738210e5f3cbe728c076d226774792
Instruction ID: 430f57d140606f1196344cdd93398c033c84af67b86e8dd13bfeb81707b78dc1
Opcode Fuzzy Hash: 8b43bd80490eb3a3119b6abd425fe28c73738210e5f3cbe728c076d226774792
Instruction Fuzzy Hash: 34C04C14E6640E01ED7837FA0D562A411806B58215FD901B0EC18C55A2E94E56D94162

Function 00007FFD9B8A2D30 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffcdc73781a3f928ebfe6ac7c12a6105f7e689ad359cce5c632de4f061215026
Instruction ID: 295623bd58614e7cc43e83df07d13df4ed588af2608ba29399f1d9978c677e67
Opcode Fuzzy Hash: ffcdc73781a3f928ebfe6ac7c12a6105f7e689ad359cce5c632de4f061215026
Instruction Fuzzy Hash: 18C01210E1A11E41EE7836F529651F421805F48218F5501F1D819850A7FD0C22850165

Function 00007FFD9B8AA288 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b99d512c6b233f389bd83e38a073aed943966d070afded07ef0cdad3519a8149
Instruction ID: d230d7f366d035c2f02e3c68ae3acc0b5bd764fff834d15e37b09e06403a85b2
Opcode Fuzzy Hash: b99d512c6b233f389bd83e38a073aed943966d070afded07ef0cdad3519a8149
Instruction Fuzzy Hash: E6A0123254640C47CF102AC0A8011D83204AB45500B010412E50D01001C96233608051

Non-executed Functions

Function 00007FFD9B8A89FA Relevance: 8.8, Strings: 7, Instructions: 75COMMON

Download Yara Rule

Strings

L_^5, xrefs: 00007FFD9B8A8A6A
L_^M, xrefs: 00007FFD9B8A8AC9
L_^K, xrefs: 00007FFD9B8A8AC2
L_^%, xrefs: 00007FFD9B8A8A2A
L_^?, xrefs: 00007FFD9B8A8A92
L_^9, xrefs: 00007FFD9B8A8A7A
L_^7, xrefs: 00007FFD9B8A8A72

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID: L_^%$L_^5$L_^7$L_^9$L_^?$L_^K$L_^M
API String ID: 0-1121904449
Opcode ID: e0abca9986c42483a2bbcd4844c4474740e94e86c784ae42007c9faa877da9e9
Instruction ID: 27b901d7107b16a51a843a7c3be5376437e132fae698f00ac72aab76c33c2d70
Opcode Fuzzy Hash: e0abca9986c42483a2bbcd4844c4474740e94e86c784ae42007c9faa877da9e9
Instruction Fuzzy Hash: BD2132B77041129A9306BEADFC955DD73A1FF9422434891F7C3A88B157EF31648B8AC0

Function 00007FFD9B8A8A20 Relevance: 8.8, Strings: 7, Instructions: 60COMMON

Download Yara Rule

Strings

L_^5, xrefs: 00007FFD9B8A8A6A
L_^M, xrefs: 00007FFD9B8A8AC9
L_^K, xrefs: 00007FFD9B8A8AC2
L_^%, xrefs: 00007FFD9B8A8A2A
L_^?, xrefs: 00007FFD9B8A8A92
L_^9, xrefs: 00007FFD9B8A8A7A
L_^7, xrefs: 00007FFD9B8A8A72

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID: L_^%$L_^5$L_^7$L_^9$L_^?$L_^K$L_^M
API String ID: 0-1121904449
Opcode ID: daf1c4fe2a4e8f0eb61d78437e5c3b4697df68e50d5a732d0e6e60b7172b224a
Instruction ID: 50354bf0334b8c0aa0b4ed87d0c70c6d7cb2194ac88dcf16af42d0e40a235556
Opcode Fuzzy Hash: daf1c4fe2a4e8f0eb61d78437e5c3b4697df68e50d5a732d0e6e60b7172b224a
Instruction Fuzzy Hash: 1011E3B67041169AD30ABEA9E8545DD7391FB9421434891F6C2A98F157EF30748B8AC0

Function 00007FFD9B8A8A30 Relevance: 7.6, Strings: 6, Instructions: 71COMMON

Download Yara Rule

Strings

L_^5, xrefs: 00007FFD9B8A8A6A
L_^M, xrefs: 00007FFD9B8A8AC9
L_^K, xrefs: 00007FFD9B8A8AC2
L_^?, xrefs: 00007FFD9B8A8A92
L_^9, xrefs: 00007FFD9B8A8A7A
L_^7, xrefs: 00007FFD9B8A8A72

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID: L_^5$L_^7$L_^9$L_^?$L_^K$L_^M
API String ID: 0-4156343526
Opcode ID: 84313904c3c7c1376b9888ed9e1bce9648dd0b3cd3589fa177f1a377f6761be6
Instruction ID: d0817b0e736c8ed3b1b23a461638057f5db423a4e6e60df6ac6d5ed2d5d443d0
Opcode Fuzzy Hash: 84313904c3c7c1376b9888ed9e1bce9648dd0b3cd3589fa177f1a377f6761be6
Instruction Fuzzy Hash: 52115BB2708016A7D30A7AAABC195DE3395FF9036430891F7D3688F147EF24708B8AD0

Function 00007FFD9B8A8A38 Relevance: 7.6, Strings: 6, Instructions: 54COMMON

Download Yara Rule

Strings

L_^5, xrefs: 00007FFD9B8A8A6A
L_^M, xrefs: 00007FFD9B8A8AC9
L_^K, xrefs: 00007FFD9B8A8AC2
L_^?, xrefs: 00007FFD9B8A8A92
L_^9, xrefs: 00007FFD9B8A8A7A
L_^7, xrefs: 00007FFD9B8A8A72

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID: L_^5$L_^7$L_^9$L_^?$L_^K$L_^M
API String ID: 0-4156343526
Opcode ID: fa2d4c77fe6183459167e7dfb6f375194c3811dd6509f8c814e21edfc432b41c
Instruction ID: 5436e5409362d8bd5110e9457fcb59740c591affaa8a5e061ae8c1c928fd3bbd
Opcode Fuzzy Hash: fa2d4c77fe6183459167e7dfb6f375194c3811dd6509f8c814e21edfc432b41c
Instruction Fuzzy Hash: 0201D6B67041169AD30A7EB9B8595DD7391FF9035434891F7C3698F197EF3460878AC0

Function 00007FFD9B8A8A60 Relevance: 7.5, Strings: 6, Instructions: 37COMMON

Download Yara Rule

Strings

L_^5, xrefs: 00007FFD9B8A8A6A
L_^M, xrefs: 00007FFD9B8A8AC9
L_^K, xrefs: 00007FFD9B8A8AC2
L_^?, xrefs: 00007FFD9B8A8A92
L_^9, xrefs: 00007FFD9B8A8A7A
L_^7, xrefs: 00007FFD9B8A8A72

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID: L_^5$L_^7$L_^9$L_^?$L_^K$L_^M
API String ID: 0-4156343526
Opcode ID: 96ecb9557abb76628f68689c8ec45f4f7832e6d34fb3ce7667aaba87e5c8b452
Instruction ID: 25970b48be694cd2cf2beff7fc3a3c22651c3edb6456ec38333b963ead861d8e
Opcode Fuzzy Hash: 96ecb9557abb76628f68689c8ec45f4f7832e6d34fb3ce7667aaba87e5c8b452
Instruction Fuzzy Hash: D0F02BB660400657D3466A66AC541DE73D2BBA4350345A1E6C3648F257FF30708749C0

Function 00007FFD9B8A8A68 Relevance: 5.0, Strings: 4, Instructions: 36COMMON

Download Yara Rule

Strings

L_^M, xrefs: 00007FFD9B8A8AC9
L_^K, xrefs: 00007FFD9B8A8AC2
L_^?, xrefs: 00007FFD9B8A8A92
L_^9, xrefs: 00007FFD9B8A8A7A

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID: L_^9$L_^?$L_^K$L_^M
API String ID: 0-1363839762
Opcode ID: b495c25067d2a58778614e03ae6a9931d197e2c5a23b2c40df1cdcf7ee968df4
Instruction ID: e49ac121904c5a344fb9e5ddda22ca88819226b41c5f1ae0d982832e19090b24
Opcode Fuzzy Hash: b495c25067d2a58778614e03ae6a9931d197e2c5a23b2c40df1cdcf7ee968df4
Instruction Fuzzy Hash: BEF0E97631441256D3066AA9B8212DE7392FBA035434560F7C3659F243EF30708749C0

Function 00007FFD9B8A8A70 Relevance: 5.0, Strings: 4, Instructions: 32COMMON

Download Yara Rule

Strings

L_^M, xrefs: 00007FFD9B8A8AC9
L_^K, xrefs: 00007FFD9B8A8AC2
L_^?, xrefs: 00007FFD9B8A8A92
L_^9, xrefs: 00007FFD9B8A8A7A

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID: L_^9$L_^?$L_^K$L_^M
API String ID: 0-1363839762
Opcode ID: 34ac87832d8d90a5e26191a7aaa4f3c7de0a2470f80199ae8e247c5164ac05aa
Instruction ID: 9f97a5944f4133e7e221f1425be473d00841c1c5f062e550256da77cd5c7fb82
Opcode Fuzzy Hash: 34ac87832d8d90a5e26191a7aaa4f3c7de0a2470f80199ae8e247c5164ac05aa
Instruction Fuzzy Hash: 0DF0ECB630801397D74B6A65AC242DE73D2BBA035430560F6C3659F243FF30708789C0

Function 00007FFD9B8A8A58 Relevance: 5.0, Strings: 4, Instructions: 21COMMON

Download Yara Rule

Strings

L_^5, xrefs: 00007FFD9B8A8A6A
L_^?, xrefs: 00007FFD9B8A8A92
L_^9, xrefs: 00007FFD9B8A8A7A
L_^7, xrefs: 00007FFD9B8A8A72

Memory Dump Source

Source File: 0000000A.00000002.2928739374.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffd9b8a0000_Treatments?Secure.jbxd

Similarity

API ID:
String ID: L_^5$L_^7$L_^9$L_^?
API String ID: 0-3024749893
Opcode ID: 947f2bf3a221f2cfb0023fe56ac388fb9dc40b13ca0bdf713002d917bf7e0668
Instruction ID: c075701548cc5e47a9248d6b5199f10cf90fb38cb054808d56c0d2b22f541b72
Opcode Fuzzy Hash: 947f2bf3a221f2cfb0023fe56ac388fb9dc40b13ca0bdf713002d917bf7e0668
Instruction Fuzzy Hash: 8EE086B6A144098AD346ED6B98845DE73A6B7E8300359D2F7D628C7627AB34508F86C0

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Tactics:	Credential Access, Discovery
Data Sources:	Command: Command Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 0039284903284902840932890840928091#U00aaharder.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Main.txt

C:\Program Files\Statistical Flexibility\Catalogs\IGD.CAT

C:\Program Files\Statistical Flexibility\ConfigSecurityPolicy.exe

C:\Program Files\Statistical Flexibility\DefenderCSP.dll

C:\Program Files\Statistical Flexibility\Drivers\WdBoot.sys

C:\Program Files\Statistical Flexibility\Drivers\WdDevFlt.sys

C:\Program Files\Statistical Flexibility\Drivers\WdFilter.sys

C:\Program Files\Statistical Flexibility\Drivers\WdNisDrv.sys

C:\Program Files\Statistical Flexibility\Microsoft-Antimalware-AMFilter.man

C:\Program Files\Statistical Flexibility\Microsoft-Antimalware-NIS.man

C:\Program Files\Statistical Flexibility\Microsoft-Antimalware-Protection.man

C:\Program Files\Statistical Flexibility\Microsoft-Antimalware-RTP.man

C:\Program Files\Statistical Flexibility\Microsoft-Antimalware-Service.man

C:\Program Files\Statistical Flexibility\Microsoft-Windows-Windows Defender.man

C:\Program Files\Statistical Flexibility\MpAsDesc.dll

C:\Program Files\Statistical Flexibility\MpClient.dll

Windows Analysis Report
0039284903284902840932890840928091#U00aaharder.exe