Edit tour

Windows Analysis Report
W4gFpExSht.exe

Overview

General Information

Sample name:	W4gFpExSht.exe renamed because original name is a hash value
Original sample name:	4331d2c1d7e3b285c951be6ab77984072044cb0085e71b448d6858c421826bc8.exe
Analysis ID:	1526558
MD5:	57e7e2151ac4443d3a30d61d4426428a
SHA1:	b2adca307d1f5d1c92cfcdac269ccf269bd8155a
SHA256:	4331d2c1d7e3b285c951be6ab77984072044cb0085e71b448d6858c421826bc8
Tags:	DoubleFaceTeamexeuser-JAMESWT_MHT
Infos:

Detection

Babuk

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found ransom note / readme

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected Babuk Ransomware

AI detected suspicious sample

Tries to harvest and steal browser information (history, passwords, etc)

Checks for available system drives (often done to infect USB drives)

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to modify clipboard data

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

W4gFpExSht.exe (PID: 2696 cmdline: "C:\Users\user\Desktop\W4gFpExSht.exe" MD5: 57E7E2151AC4443D3A30D61D4426428A)

conhost.exe (PID: 5304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Babuk	Babuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux are the most used compiled versions, but ESX and a 32bit old PE executable were observed over time. as well It uses an Elliptic Curve Algorithm (Montgomery Algorithm) to build the encryption keys.	No Attribution	http://chuongdong.com/reverse%20engineering/2021/01/03/BabukRansomware/ https://blog.cyble.com/2022/05/06/rebranded-babuk-ransomware-in-action-darkangels-ransomware-performs-targeted-attack/ https://blog.morphisec.com/babuk-ransomware-variant-major-attack https://blog.talosintelligence.com/2021/11/babuk-exploits-exchange.html https://chuongdong.com/reverse%20engineering/2021/01/16/BabukRansomware-v3/	https://malpedia.caad.fkie.fraunhofer.de/details/win.babuk

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: W4gFpExSht.exe PID: 2696	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for domain / URL

Source: https://autodiscover.com/Autodiscover/Autodiscover.xml

Virustotal: Detection: 6%

Perma Link

Multi AV Scanner detection for submitted file

Source: W4gFpExSht.exe	Virustotal: Detection: 67%			Perma Link
Source: W4gFpExSht.exe	ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 96.7% probability

Source: W4gFpExSht.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\.ms-ad\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\3D Objects\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\336a045b-df12-4067-9f71-93ee2edb038d\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cookie\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\ARM\Acrobat_23.006.20320\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\ARM\S\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5}\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\ARM\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\Color\Profiles\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\Color\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\CEF\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\CEF\User Data\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\Unistore\data\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\Unistore\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\D3DSCache\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v2.0_32\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0_32\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Credentials\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\FontCache\4\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\FontCache\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\GameDVR\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\af-ZA\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-AE\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-BH\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-DZ\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-EG\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-IQ\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-JO\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-KW\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-LB\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-LY\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-MA\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-OM\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-QA\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-SA\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-SY\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-TN\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-YE\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\bg-BG\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\bn-BD\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ca-ES\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\cs-CZ\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\da-DK\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\de-AT\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\de-CH\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\de-DE\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\de-LI\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\de-LU\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\el-GR\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-029\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-AU\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-BZ\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-CA\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-GB\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-HK\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-ID\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-IE\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-IN\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-JM\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-MY\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-NZ\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-SG\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-TT\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-ZA\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-ZW\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-419\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-AR\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-BO\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-CL\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-CO\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-CR\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-DO\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-EC\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-ES\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-GT\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-HN\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-MX\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-NI\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-PA\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-PE\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-PR\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-PY\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-SV\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-US\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-UY\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-VE\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\et-EE\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\eu-ES\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fa-IR\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fi-FI\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-029\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-BE\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-CA\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-CD\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-CH\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-CI\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-CM\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-FR\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-HT\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-LU\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-MA\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-MC\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-ML\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-RE\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-SN\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\gl-ES\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\he-IL\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\hi-IN\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\hr-BA\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\hr-HR\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\hu-HU\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\hy-AM\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\id-ID\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\it-CH\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\it-IT\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ka-GE\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\kk-KZ\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\lt-LT\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\lv-LV\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\mk-MK\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ms-BN\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ms-MY\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\nb-NO\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\nl-BE\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\nl-NL\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\pl-PL\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\pt-BR\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\pt-PT\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ro-MD\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ro-RO\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ru-RU\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\sk-SK\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\sl-SI\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\sq-AL\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\sv-FI\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\sv-SE\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\tr-TR\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\uk-UA\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\DxxAlien_ReadMe.txt	Jump to behavior

Source:	Binary string: Error while loading symbolsUnable to locate the .pdb file in any of the symbol search source: dbghelp.dll.daenc.0.dr
Source:	Binary string: zzz_AsmCodeRange_*FrameDatainvalid string positionstring too long.pdb source: dbghelp.dll.daenc.0.dr
Source:	Binary string: Pdb read access deniedYou may be attempting to access a .pdb file with read-only attributes source: dbghelp.dll.daenc.0.dr
Source:	Binary string: Unable to locate the .pdb file in this location source: dbghelp.dll.daenc.0.dr
Source:	Binary string: Unrecognized pdb formatThis error indicates attempting to access a .pdb file with source: dbghelp.dll.daenc.0.dr
Source:	Binary string: A connection with the server could not be establishedAn extended error was returned from the WinHttp serverThe .pdb file is probably no longer indexed in the symbol server share location. source: dbghelp.dll.daenc.0.dr
Source:	Binary string: .pdb.dbg source: dbghelp.dll.daenc.0.dr
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: chrome.exe.daenc.0.dr
Source:	Binary string: Drive not readyThis error indicates a .pdb file relR source: dbghelp.dll.daenc.0.dr
Source:	Binary string: Cvinfo is corruptThe .pdb file contains a corrupted debug codeview information. source: dbghelp.dll.daenc.0.dr
Source:	Binary string: or you do not have access permission to the .pdb location. source: dbghelp.dll.daenc.0.dr
Source:	Binary string: Downloading symbols for [%s] %ssrvsymsrvhttp://https://_bad_pdb_file.pdb source: dbghelp.dll.daenc.0.dr
Source:	Binary string: Signature does not matchThe module signature does not match with .pdb signature source: dbghelp.dll.daenc.0.dr
Source:	Binary string: The symbol server has never indexed any version of this symbol fileNo version of the .pdb file with the given name has ever been registered. source: dbghelp.dll.daenc.0.dr
Source:	Binary string: dbghelp.pdb source: dbghelp.dll.daenc.0.dr
Source:	Binary string: PDB not foundUnable to locate the .pdb file in any of the symbol search path locations. source: dbghelp.dll.daenc.0.dr
Source:	Binary string: d:\dbs\sh\odct\1105_210049_0\client\onedrive\Setup\Standalone\exe\obj\i386\OneDriveSetup.pdb source: wctFE34.tmp.daenc.0.dr
Source:	Binary string: dbghelp.pdbGCTL source: dbghelp.dll.daenc.0.dr

Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: z:	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: x:	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: v:	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: t:	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: r:	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: p:	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: n:	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: l:	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: j:	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: h:	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: f:	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: b:	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: y:	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: w:	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: u:	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: s:	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: q:	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: o:	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: m:	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: k:	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: i:	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: g:	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: e:	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\Desktop\W4gFpExSht.exe

Code function: 0_2_00422240 GetSystemDirectoryW,wsprintfW,wsprintfW,wsprintfW,FindFirstFileW,Sleep,FindNextFileW,FindClose,FindClose,

0_2_00422240

Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\336a045b-df12-4067-9f71-93ee2edb038d\	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\	Jump to behavior

Source: dbghelp.dll.daenc.0.dr	String found in binary or memory: http://https://_bad_pdb_file.pdb
Source: W4gFpExSht.exe, 00000000.00000002.3951392901.0000000001967000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autodiscover.com/Autodiscover/Autodiscover.xml
Source: W4gFpExSht.exe, 00000000.00000002.3951392901.0000000001967000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autodiscover.com/autodiscover/autodiscover.xml
Source: W4gFpExSht.exe, 00000000.00000002.3951392901.0000000001967000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autodiscover.sg/Autodiscover/Autodiscover.xml
Source: W4gFpExSht.exe, 00000000.00000002.3951392901.0000000001967000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autodiscover.uk/autodiscover/autodiscover.xml
Source: wctFE34.tmp.daenc.0.dr	String found in binary or memory: https://dc.services.visualstudio.com/v2/track
Source: wctFE34.tmp.daenc.0.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/win81https://g.live.com/1rewlive5skydrive/win8https://g.live.co
Source: wctFE34.tmp.daenc.0.dr	String found in binary or memory: https://g.live.com/odclientsettings/Enterprisehttps://g.live.com/odclientsettings/MsitFasthttps://g.

Source: C:\Users\user\Desktop\W4gFpExSht.exe

Code function: 0_2_00421840 SHGetFolderPathA,SHGetFolderPathA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetModuleHandleW,LoadImageW,SetWindowPos,SetTimer,GetWindowLongW,LoadBitmapW,BeginPaint,CreateCompatibleDC,SelectObject,SelectObject,GetObjectW,GetClientRect,SetStretchBltMode,StretchBlt,SetTextColor,SetBkMode,SetRect,CreateFontA,SelectObject,DrawTextA,SelectObject,DeleteDC,EndPaint,GetDlgItem,GetDlgItem,ShowWindow,ShowWindow,GetDlgItem,ShowWindow,GetWindowLongW,LoadBitmapW,BeginPaint,CreateCompatibleDC,SelectObject,SelectObject,GetObjectW,GetClientRect,SetStretchBltMode,StretchBlt,SetTextColor,SetBkMode,SetRect,CreateFontA,SelectObject,DrawTextA,SelectObject,DeleteDC,EndPaint,MessageBoxW,GetDlgItemTextA,MessageBoxA,SHGetFolderPathA,EndDialog,GlobalAlloc,GlobalLock,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,InvalidateRect,KillTimer,SHGetFolderPathA,MessageBoxW,

0_2_00421840

Source: C:\Users\user\Desktop\W4gFpExSht.exe

0_2_00421840

Spam, unwanted Advertisements and Ransom Demands

Found ransom note / readme

Source: C:\Users\user\.ms-ad\DxxAlien_ReadMe.txt

Dropped file: Greetings the @world.Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly...Just follow me...Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes...BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9ltEtherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952

Jump to dropped file

Yara detected Babuk Ransomware

Source: Yara match

File source: Process Memory Space: W4gFpExSht.exe PID: 2696, type: MEMORYSTR

Source: C:\Users\user\Desktop\W4gFpExSht.exe	Code function: 0_2_0041F2A0	0_2_0041F2A0
Source: C:\Users\user\Desktop\W4gFpExSht.exe	Code function: 0_2_0041CC10	0_2_0041CC10
Source: C:\Users\user\Desktop\W4gFpExSht.exe	Code function: 0_2_0040841F	0_2_0040841F
Source: C:\Users\user\Desktop\W4gFpExSht.exe	Code function: 0_2_004140C0	0_2_004140C0
Source: C:\Users\user\Desktop\W4gFpExSht.exe	Code function: 0_2_004080DD	0_2_004080DD
Source: C:\Users\user\Desktop\W4gFpExSht.exe	Code function: 0_2_0041456B	0_2_0041456B
Source: C:\Users\user\Desktop\W4gFpExSht.exe	Code function: 0_2_00418D0F	0_2_00418D0F
Source: C:\Users\user\Desktop\W4gFpExSht.exe	Code function: 0_2_0041FDE0	0_2_0041FDE0
Source: C:\Users\user\Desktop\W4gFpExSht.exe	Code function: 0_2_0041BA40	0_2_0041BA40
Source: C:\Users\user\Desktop\W4gFpExSht.exe	Code function: 0_2_0040877E	0_2_0040877E

Source: C:\Users\user\Desktop\W4gFpExSht.exe

Code function: String function: 00420F90 appears 52 times

Source: W4gFpExSht.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal60.rans.spyw.winEXE@2/374@0/0

Source: C:\Users\user\Desktop\W4gFpExSht.exe

File created: C:\Users\user\AppData\Roaming\time.dat

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5304:120:WilError_03

Source: C:\Users\user\Desktop\W4gFpExSht.exe

File created: C:\Users\user\AppData\Local\Temp\tmp.bmp

Jump to behavior

Source: W4gFpExSht.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\W4gFpExSht.exe

File read: C:\Users\user\3D Objects\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\W4gFpExSht.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: wctFE34.tmp.daenc.0.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: wctFE34.tmp.daenc.0.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: wctFE34.tmp.daenc.0.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

Source: W4gFpExSht.exe	Virustotal: Detection: 67%
Source: W4gFpExSht.exe	ReversingLabs: Detection: 60%

Source: unknown	Process created: C:\Users\user\Desktop\W4gFpExSht.exe "C:\Users\user\Desktop\W4gFpExSht.exe"
Source: C:\Users\user\Desktop\W4gFpExSht.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\W4gFpExSht.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	Section loaded: textshaping.dll	Jump to behavior

Source: C:\Users\user\Desktop\W4gFpExSht.exe	Automated click: OK
Source: C:\Users\user\Desktop\W4gFpExSht.exe	Automated click: OK
Source: C:\Users\user\Desktop\W4gFpExSht.exe	Automated click: OK
Source: C:\Users\user\Desktop\W4gFpExSht.exe	Automated click: OK
Source: C:\Users\user\Desktop\W4gFpExSht.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: W4gFpExSht.exe

Static file information: File size 21261312 > 1048576

Source: W4gFpExSht.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x141b200

Source: W4gFpExSht.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Error while loading symbolsUnable to locate the .pdb file in any of the symbol search source: dbghelp.dll.daenc.0.dr
Source:	Binary string: zzz_AsmCodeRange_*FrameDatainvalid string positionstring too long.pdb source: dbghelp.dll.daenc.0.dr
Source:	Binary string: Pdb read access deniedYou may be attempting to access a .pdb file with read-only attributes source: dbghelp.dll.daenc.0.dr
Source:	Binary string: Unable to locate the .pdb file in this location source: dbghelp.dll.daenc.0.dr
Source:	Binary string: Unrecognized pdb formatThis error indicates attempting to access a .pdb file with source: dbghelp.dll.daenc.0.dr
Source:	Binary string: A connection with the server could not be establishedAn extended error was returned from the WinHttp serverThe .pdb file is probably no longer indexed in the symbol server share location. source: dbghelp.dll.daenc.0.dr
Source:	Binary string: .pdb.dbg source: dbghelp.dll.daenc.0.dr
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: chrome.exe.daenc.0.dr
Source:	Binary string: Drive not readyThis error indicates a .pdb file relR source: dbghelp.dll.daenc.0.dr
Source:	Binary string: Cvinfo is corruptThe .pdb file contains a corrupted debug codeview information. source: dbghelp.dll.daenc.0.dr
Source:	Binary string: or you do not have access permission to the .pdb location. source: dbghelp.dll.daenc.0.dr
Source:	Binary string: Downloading symbols for [%s] %ssrvsymsrvhttp://https://_bad_pdb_file.pdb source: dbghelp.dll.daenc.0.dr
Source:	Binary string: Signature does not matchThe module signature does not match with .pdb signature source: dbghelp.dll.daenc.0.dr
Source:	Binary string: The symbol server has never indexed any version of this symbol fileNo version of the .pdb file with the given name has ever been registered. source: dbghelp.dll.daenc.0.dr
Source:	Binary string: dbghelp.pdb source: dbghelp.dll.daenc.0.dr
Source:	Binary string: PDB not foundUnable to locate the .pdb file in any of the symbol search path locations. source: dbghelp.dll.daenc.0.dr
Source:	Binary string: d:\dbs\sh\odct\1105_210049_0\client\onedrive\Setup\Standalone\exe\obj\i386\OneDriveSetup.pdb source: wctFE34.tmp.daenc.0.dr
Source:	Binary string: dbghelp.pdbGCTL source: dbghelp.dll.daenc.0.dr

Source: C:\Users\user\Desktop\W4gFpExSht.exe

Code function: 0_2_00419421 push ecx; ret

0_2_00419434

Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\.ms-ad\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\3D Objects\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\336a045b-df12-4067-9f71-93ee2edb038d\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cookie\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\AcroCef\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\ARM\Acrobat_23.006.20320\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\ARM\S\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5}\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\ARM\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\Color\Profiles\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\Color\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Adobe\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\CEF\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\CEF\User Data\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\Unistore\data\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\Unistore\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Comms\UnistoreDB\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\D3DSCache\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\Low\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v2.0_32\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v4.0_32\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Credentials\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\FontCache\4\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\FontCache\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\GameDVR\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\af-ZA\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-AE\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-BH\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-DZ\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-EG\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-IQ\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-JO\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-KW\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-LB\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-LY\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-MA\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-OM\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-QA\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-SA\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-SY\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-TN\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ar-YE\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\bg-BG\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\bn-BD\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ca-ES\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\cs-CZ\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\da-DK\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\de-AT\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\de-CH\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\de-DE\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\de-LI\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\de-LU\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\el-GR\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-029\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-AU\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-BZ\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-CA\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-GB\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-HK\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-ID\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-IE\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-IN\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-JM\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-MY\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-NZ\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-SG\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-TT\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-ZA\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\en-ZW\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-419\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-AR\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-BO\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-CL\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-CO\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-CR\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-DO\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-EC\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-ES\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-GT\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-HN\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-MX\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-NI\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-PA\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-PE\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-PR\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-PY\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-SV\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-US\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-UY\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\es-VE\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\et-EE\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\eu-ES\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fa-IR\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fi-FI\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-029\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-BE\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-CA\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-CD\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-CH\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-CI\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-CM\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-FR\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-HT\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-LU\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-MA\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-MC\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-ML\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-RE\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\fr-SN\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\gl-ES\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\he-IL\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\hi-IN\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\hr-BA\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\hr-HR\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\hu-HU\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\hy-AM\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\id-ID\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\it-CH\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\it-IT\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ka-GE\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\kk-KZ\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\lt-LT\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\lv-LV\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\mk-MK\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ms-BN\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ms-MY\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\nb-NO\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\nl-BE\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\nl-NL\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\pl-PL\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\pt-BR\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\pt-PT\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ro-MD\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ro-RO\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\ru-RU\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\sk-SK\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\sl-SI\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\sq-AL\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\sv-FI\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\sv-SE\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\tr-TR\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\uk-UA\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\input\DxxAlien_ReadMe.txt	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Media Player\DxxAlien_ReadMe.txt	Jump to behavior

Source: C:\Users\user\Desktop\W4gFpExSht.exe	Window / User API: threadDelayed 4472	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	Window / User API: threadDelayed 482	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	Window / User API: threadDelayed 487	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	Window / User API: threadDelayed 2231	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 4644	Jump to behavior

Source: C:\Users\user\Desktop\W4gFpExSht.exe TID: 6672	Thread sleep time: -4472000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe TID: 6672	Thread sleep time: -2231000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\W4gFpExSht.exe

Code function: 0_2_00422240 GetSystemDirectoryW,wsprintfW,wsprintfW,wsprintfW,FindFirstFileW,Sleep,FindNextFileW,FindClose,FindClose,

0_2_00422240

Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\336a045b-df12-4067-9f71-93ee2edb038d\	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\	Jump to behavior

Source: C:\Users\user\Desktop\W4gFpExSht.exe

API call chain: ExitProcess graph end node

graph_0-11086

Source: C:\Users\user\Desktop\W4gFpExSht.exe

Code function: 0_2_0040DC46 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0040DC46

Source: C:\Users\user\Desktop\W4gFpExSht.exe	Code function: 0_2_0040DC46 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0040DC46
Source: C:\Users\user\Desktop\W4gFpExSht.exe	Code function: 0_2_00401C9A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00401C9A

Source: C:\Users\user\Desktop\W4gFpExSht.exe

Code function: 0_2_00401617 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00401617

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\LOG	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Favicons	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Crashpad\metadata	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Shortcuts	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Last Browser	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ShaderCache\data_3	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\LOCK	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ShaderCache\data_2	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ShaderCache\data_1	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ShaderCache\index	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Variations	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\ShaderCache\data_0	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\First Run	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Last Version	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Top Sites	Jump to behavior
Source: C:\Users\user\Desktop\W4gFpExSht.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\DIPS	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	1 Data from Local System	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Clipboard Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	11 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	2 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
W4gFpExSht.exe	67%	Virustotal		Browse
W4gFpExSht.exe	61%	ReversingLabs	Win32.Virus.Generic

Source	Detection	Scanner	Link
https://dc.services.visualstudio.com/v2/track	0%	Virustotal	Browse
https://autodiscover.com/Autodiscover/Autodiscover.xml	6%	Virustotal	Browse
https://autodiscover.uk/autodiscover/autodiscover.xml	0%	Virustotal	Browse
https://autodiscover.sg/Autodiscover/Autodiscover.xml	2%	Virustotal	Browse
https://g.live.com/odclientsettings/Enterprisehttps://g.live.com/odclientsettings/MsitFasthttps://g.	0%	Virustotal	Browse
https://g.live.com/1rewlive5skydrive/win81https://g.live.com/1rewlive5skydrive/win8https://g.live.co	0%	Virustotal	Browse

Name	Source	Malicious	Antivirus Detection	Reputation
https://autodiscover.com/Autodiscover/Autodiscover.xml	W4gFpExSht.exe, 00000000.00000002.3951392901.0000000001967000.00000004.00000020.00020000.00000000.sdmp	false	6%, Virustotal, Browse	unknown
https://autodiscover.sg/Autodiscover/Autodiscover.xml	W4gFpExSht.exe, 00000000.00000002.3951392901.0000000001967000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse	unknown
https://autodiscover.com/autodiscover/autodiscover.xml	W4gFpExSht.exe, 00000000.00000002.3951392901.0000000001967000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://dc.services.visualstudio.com/v2/track	wctFE34.tmp.daenc.0.dr	false	0%, Virustotal, Browse	unknown
https://autodiscover.uk/autodiscover/autodiscover.xml	W4gFpExSht.exe, 00000000.00000002.3951392901.0000000001967000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://https://_bad_pdb_file.pdb	dbghelp.dll.daenc.0.dr	false		unknown
https://g.live.com/1rewlive5skydrive/win81https://g.live.com/1rewlive5skydrive/win8https://g.live.co	wctFE34.tmp.daenc.0.dr	false	0%, Virustotal, Browse	unknown
https://g.live.com/odclientsettings/Enterprisehttps://g.live.com/odclientsettings/MsitFasthttps://g.	wctFE34.tmp.daenc.0.dr	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1526558
Start date and time:	2024-10-06 10:13:43 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	W4gFpExSht.exe renamed because original name is a hash value
Original Sample Name:	4331d2c1d7e3b285c951be6ab77984072044cb0085e71b448d6858c421826bc8.exe
Detection:	MAL
Classification:	mal60.rans.spyw.winEXE@2/374@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 76% Number of executed functions: 19 Number of non-executed functions: 25
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:15:11	API Interceptor	6086390x Sleep call for process: W4gFpExSht.exe modified
04:16:52	API Interceptor	1407x Sleep call for process: conhost.exe modified

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1068
Entropy (8bit):	4.263633622188942
Encrypted:	false
SSDEEP:	24:y6UyIVarNBzayFDzPvGWTaqVuWgUGQcNRTrlXlfU3d+4UykF7hW14/JK0B:HUDYNBGyvvVVpg4aRncHUySo0B
MD5:	161F3B25CD235EAC29AAADA831AFDB0B
SHA1:	119BFACDDE1C8C743DB5673849C73A50A045A9F1
SHA-256:	A123D61F35C836961E640CBC8E60EA47ACB22799291BC1F34C223FA7DC3BE9E0
SHA-512:	1EFBB8055F60800B15B1ED1E711BDCE6A9702540FA57A98D50F4E14F250E7647363F95C9A59C30FCECA09A057FAC657B56D91C283D7ADCC0152E362CD279FF27
Malicious:	false
Reputation:	low
Preview:	.nC..<.X.F....}..f)..;s....H.L.---8+8---1dad19fa7097d199c4a6cfcaea8da38fd3faef73bcfcf220a27e6cb23920d8c27bb2790d857183c36634b75979467059bead738cf408e47b96d1167dee2276c8b9c9958b43d087d01a33f4c8a9f397bdf8d1318b539136509be20596b1a8a7ae262b1c6ffe3db5df33b6c5847100263003fb984aa386f93aeded3cf1fcde5fb745b459968cc59589cf48f47d95f2e314dd576667b359474265853217ce10a35d9156cf31933f175640cb45ce206a86b4bf62ffbd701156c2acf4c653b8ee6cfb9c5853cc02b96683a836a6f5bd74100b3c1011f7350ded58834dfbe772f2826a9284f7bc9159ce604311c0b3a698e068fcaf5722fa267e839d1f51e36aef2150c28ed7e6f61d49ede5c8f493a8b54b64ddd8a4441c78cc5e44b4201c88159edbfa19377c304a20a61548683a084816ca4460acc5add1fdb1f16b73f7f7147f7ce704d388ed621780d3b0c9f5f79d3b00ee1f5c3c232cc352ace35a4feb6109f0bb6da1de8b2ec0fd59281ceec41965d6345fea22af8e7521310392f5eb5730b49f020e7a16ecdfd4d719ee1a25d5afe32131ba6e2c2d7d3fc66b81aad8fac66c7c2fa099f6af0b603bedebbaa0f924938c09a62ac9eab0946ab67059b8c351261a6c82542c81e2fe1ff0dee5a1e1cd1f8a52e9bf183a513955cad30dee9c4

C:\Users\user\.ms-ad\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	true
Reputation:	low
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\3D Objects\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Reputation:	low
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\3D Objects\desktop.ini.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1356
Entropy (8bit):	5.488396294631141
Encrypted:	false
SSDEEP:	24:8CFsuYt4GOxODcyIVarNBzayFDzPvGWTaqVuWgUGQcNRTrlXlfU3d+4UykF7hW1q:82YtLo9DYNBGyvvVVpg4aRncHUySo0B
MD5:	86F8844A9524A8C63F829CB4101A03A3
SHA1:	15DDE12B4D775F2BA24C610D34FE3AA1C1997409
SHA-256:	C5A8F9D41F6F350B8F1B9903ADCC15D49AA93D2DBB40A895E03E8CCB5CCB8FDC
SHA-512:	7D78CA658ABA6C6541C814D7056E22FD9289669B719087665E8321F5498892B44A87AF61E95B9BAE0D454BAA70185231FB27117E924ED79195F6BA1DFA2B3D93
Malicious:	false
Reputation:	low
Preview:	.nC..<.X.F....}q........q....b......0&..i......~....E.=....T...O.cB..%.cA.^...m.K..C aE=. .k?.../pV.8.Pdb...X9.5.y..]<..v....p.L..H...I.....{sW.p..\|...J.....1...}4v...Y...4I..FO.L.<.E0.$$gBc...U...f .....9..........O.R.<.]...}jp2.q.1..c...o/...{dQ}.<?.../2./>.],..5...R.....,.b..+..~...S#...F...%.^...---8+8*---1dad19fa7097d199c4a6cfcaea8da38fd3faef73bcfcf220a27e6cb23920d8c27bb2790d857183c36634b75979467059bead738cf408e47b96d1167dee2276c8b9c9958b43d087d01a33f4c8a9f397bdf8d1318b539136509be20596b1a8a7ae262b1c6ffe3db5df33b6c5847100263003fb984aa386f93aeded3cf1fcde5fb745b459968cc59589cf48f47d95f2e314dd576667b359474265853217ce10a35d9156cf31933f175640cb45ce206a86b4bf62ffbd701156c2acf4c653b8ee6cfb9c5853cc02b96683a836a6f5bd74100b3c1011f7350ded58834dfbe772f2826a9284f7bc9159ce604311c0b3a698e068fcaf5722fa267e839d1f51e36aef2150c28ed7e6f61d49ede5c8f493a8b54b64ddd8a4441c78cc5e44b4201c88159edbfa19377c304a20a61548683a084816ca4460acc5add1fdb1f16b73f7f7147f7ce704d388ed621780d3b0c9f5f79d3

C:\Users\user\AppData\Local\.curlrc.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1068
Entropy (8bit):	4.260191171845335
Encrypted:	false
SSDEEP:	24:U19NortH+lmF3WIf/7mCliH+m9pE+VS27tItC:USr+a5f/CCJmbJVS27V
MD5:	E75C626F1438EB249B0AF25D31B2205F
SHA1:	5A167F837A4C433D2FE94E4B48B691E9ECF28395
SHA-256:	64174C5FCFEA4E81FB782868B0395E740A996AF58383AAEE5D44D248C017C092
SHA-512:	F6B013E56C018ED8CAF962CA5E33C72FED145C1A6C57CCAE39949ECEA5738AC0E80742C8505C23F8EFF426D80099FF414888A449A2D6E01E7182A33A97A39286
Malicious:	false
Reputation:	low
Preview:	....S.]...;.{i.J.]j......y"..%---8+8---654ee88cb79c15b7b20148bbcfb25a616a46ce8ff70d3d06abab72be432d808938579a5bca8ff9e8914e50a740942f3c53b25bf90198942f539fe9af86bced35f5c8f6576a0bbfae97aa930b697fca521c381a4d7ad8bf389f3692a0210865f83aca8bc17075d6ac659c69ca95b8f128d6e12ac86f3c641b7a04ee521fc7aa2126b2d7e01a6d4fe341012ef2af3ca500ec26a89c9f46a2b3b9f2a57360101aa87c46f171cc0157bb7a1066a11ffaf1ab982056e3b79ca8ccfd216c46f3afde6d444d95a52df59bbd603bb8de6fe39e8b9bbb6f999fafc0dfed6020dd5c373e93b5cb77b40e10c2f5b13a3eaf471a3bd1b524f1f22dbf36172f598415ccea47c838276ea232739414bb44e82928373a8e193a0c1e87cb9a28e258d931e81782d99eb66b55a8406b0139d3676d445fa0973db71b588ede3dcca9bdbc4fbc77f0b95ebdfe0be048055b89ea6fc7d8c409f3fbcf5c888701cdaa780f59f1945db285f8a7809001e10b8edd7ee82d253199a5becf399e8b88695a30c4162853c48fc3e872fd1674e9d2ec75332f123a48cd6a564f94ad34252176a815978daa657c5b62eb2d008a65d17be057da41c1b3ff5315ea77ab0f5cc32e2c10353d73a18a7f32eea76752c2ecb127b29d6adf93fc68eb66a65cf224da79fa826f239f784

C:\Users\user\AppData\Local\Adobe\ARM\Acrobat_23.006.20320\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Reputation:	low
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Adobe\ARM\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Adobe\ARM\S\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5}\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\CURRENT.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1068
Entropy (8bit):	4.256710767924944
Encrypted:	false
SSDEEP:	24:u20czHRlJRjFaiLBcXRe6OKmh0qXXbCabK1xY0XLpXJ+K0:AcNRxaiLsnbGrCtY0XF6
MD5:	2FA1129F6A9B8D9433D5E9FF0E53F484
SHA1:	7AA02B068F36D891FE2CC8369DD96A5993F9FFF0
SHA-256:	5FB4C94C26535944C605D569DE77FB538915E2DABC5D1316D3D8919F90AA2990
SHA-512:	A6C41D28DC309374934B913DB063C50E2B489DDF27B19568E9125C9BBE0D27B0A8166FA71D1E99C3A25F7AB7BBA37AC5522F264891A6AE2829BC7E6F70C1EB65
Malicious:	false
Preview:	.......mYS.~.}u/H...~h..bE`...Z---8+8---601a01949cc7d9574a4189c7eed92b444b157c53f3dc950aaacc8609d5ca71c8d744421e969a8d6046f62bb8304ab877bbdcaee4f46cb964a26aa04a70ca3b4b7e1ea7a519542c75d49f7e97d7ff46456ce88913199932b2eb42111067a00b8a0289f94c15c0dde8ec13f0a30be84740b50c1fb561cfac21e466a609300fb48d850f0ab78e6d4f46261904711483a00ff457c7245bfd8fd77f3d4b6369586a11bec27b5da788b2518ad7e55806b3dede55bd6cf4b6a26c5db9c0dc62d7249e74727f2992b408845028c4bc767d270c672911f77abfe7da8123ab47beb3576410fa113f894b909f93ce2e86895e9656d92d8cc2d55eb09f1074f51b400964b48264dcd168bd1eecf4ce54aab4b4cfe991bc0b9343cc71e170554bef3ed4274379a46032e956f788658b604e12495e192d0a452e56816a95421b39153e101c6e1c000b1baafc8b336b1904b78d80f314f22edc8f5a93056baca9614444f98dff68fe0a8149bfc3ee00d852df058e822d7cf9102f7108f8af62247942fdf39e96640365da6a6c462a2d94cf661b38e967b1a2370913de007ffafaaaf15dfd19c083a230e8345b32c718870dfe1a9e0d132e3f2d15ebd4833217d13c067edc49d188b59e3c56d5ccea3e12bdc12c18bac266fc2e519fceb31df9fc01c919cbb2b

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	9244
Entropy (8bit):	2.2773604147346242
Encrypted:	false
SSDEEP:	48:t8IgO2Dn/huUsfUY3vGdyNUOXCiWVmuLjZ8xKThx0l7FZyoa:ijZtssY+aPXCiMR6xEEyT
MD5:	CFBA62E5D5FFF5EF8A7858BC7B6D4C1C
SHA1:	69176CBA23A77BE9C544FB2FEB2A2EA99EF724C8
SHA-256:	746C3E5522182049717F05F1F9D7B900CA29CB0332BD85E25FD9381A4B5C0D4E
SHA-512:	69D643CF3D0D20694943CE69332747E4D4C651F11F5EF0B6771A563E084C7E140E5AA0F385BA860AD881CEC8975973DB0F0E74F85ACEB36981D35113A7F531F2
Malicious:	false
Preview:	....8%.Y..g[^....Xhk7..u........pV0...^1L..K.x.....~;..(<l.......H....B0..(...]....j...."._...@R..s.~.C\.6~.A...@{..U.%..R.i.......'.b.B.j...........O.x.15.A..v.j.:...m..4.V6~.V.H.3..=.....).Gx...yJh."P........1..m...F..rVe2.2os.,wn$j....p....3.C:.t.1.r.CK..d..8w<....~...m].:.W..O.rYl.....+.I...d..L...i...\...}9.~..c..#....7.z.oD:q.......a,.oZ..yJp.$.ip9..B...Q.w.W0W.).s.....^,V..ag}.l.?..YG.f...4.h...j.`....u>"?Q$.L.?!..:...E\..t.6.N.#..(>.1X.6...XE.<..+.DESR.....r..ky..J>h.0.:..P......n..U.7....$(..[.6...{..6..5..WBZ.............c~O...gVi-.3.W...`....c....L.0&...).....3X.!.Z....h`}0/cFB..#.....m......8....?...l..D.3X.....;F...cz....aaPiH`a..d@.06.....z......N?.h.....a..%7+.w.eVj).............Gb.f.E.....X.D.i+.U.j..{.1....NP..i.Q..n.2.. ...?...4.S%(...S.2).edY..Z....D.....).#&..\,.n}kT....3.d...\|C...}F....K.%.9.....(..!<.$..H...z...}.2...7..R...5,L.`.W.......V..i.%BZ.@.....A.N.E..T.S5.....M1..\...J..K. E....Vk.-../.

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_1.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	271388
Entropy (8bit):	1.3261817295966802
Encrypted:	false
SSDEEP:	768:ezMxLGEfNGsjqa19v8gbySruBS8cwDlD5WM62z8qk9:1f4sjL9v8g+mwDlD5Wp2AX9
MD5:	FD494F62AB1B463107C93A3FBDB8384F
SHA1:	FF9672291EF4CB00D688143C201000A3B3A086D2
SHA-256:	D93890E5B605B9B8F64C13EBEF27D741B2F13C16368FEDC3F692C843FC6A585C
SHA-512:	6BDA9C897604B43C86F9541BD377B344C1E7ED530512D0FF218C3ECE4869EF6B6D36AAEA8011B8A8E645BFE315DEDF93BD678DFB3152E92F847EFCEC49880D2E
Malicious:	false
Preview:	....8%.Y..g[^..}S./.a..+..'.R....r..z.... ....Do.s/.o.....b~..n..o:._K.Y_..>...c....8..Z....@(.XJk....z..8..p...G.W.c.k.p...k.c...D...X....$..V...E...Z.v.........xB.sGP0q.&.x.iI..tV...=.>...]....g.n...?.j...Z[.....8._.d.J."...&...B...".!.t...YK..m.H..&..T .[%...+.r..rPG...9......\^.-.A......'...98.a$k...Q.....!!..k.1.G'...8.1.E......c.b..Y..3)...5..]..F.[...f%.(..T.....W4..5.J..A...?,....h..H..l..C......{....TN.S2`.[N.L-......q.t...Oyn...kq..D./1.^..I.W........Z...;......<..]G..Sn...E.nL..Q.o..&....Q..0P....[Fd.f..:3B$.svt@H.......z..F..3..x>..v..._L;c6..p.5..@.+.O...n\|.P[m..}...I.R....x.8.0.4Q...1.qK.$...y..Kq.-.\|.f.5..6.[...%..nm.92o...5..6.].{.N.n.[g..]_....0.(1.\|2..e........u......C.4U.........>....l.....X. .(..RY.4.<.VH[....yJ.y../Y.4T..E\|..).....E.<.z?E.i.y.7...b.....QF.GQu.G.......q?1.G+\|....0(`l._........w.iv...q.~..3..V....X.ad..Tw..I5](.1....8.N..2t`.s.A0v.. 1..........r.t....'I.k.].S62.-.Ko.S..W....5.Ow..<....6..]l...p.2Oj

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_2.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	9244
Entropy (8bit):	2.2857713535492565
Encrypted:	false
SSDEEP:	48:adta1kSUHbspInbxJI3R5utlht93muLjZ8xKThx0l7FZyoa:a7a1JUXnbxO3nSP93R6xEEyT
MD5:	CA7FC5563442D8D6531894998A96E66F
SHA1:	20689EF7565F67C048BAA49587112C82D25E379A
SHA-256:	75A929091C3B066EA8AC400778FD0BFE2DCD45E5EE5095D6A5487A745B2EAD86
SHA-512:	631D80124DE9701F91C12AFF5CBD6C94EA3A4B1B75AE7F94BBC534E336B2B2185AD19BB0ABF4A5E431E7DF1A61A95BED35452A1B7768EBCD7E46726891B3D268
Malicious:	false
Preview:	....8%.Y..g[^..#..U...!}B..X..:.B.Le.....e#......".W...tY..X.Ggm...'(.........T..U...n...r,.....as.<..1....X.-.;F......H...:.p.~..6)..J...".(.1+.....I.v/.n.`..v\.j?pj.>.B.9.8..)n....vs....yA.....7.>v%.u:j.Il..1..,..,..&.i`.C.H...%p.P@-.v.%...,p...H\|I.W......V.)._}.....!J.o..c}.\|.....D.~86........lZ..f...\|cO........c.(4.......@..l3....R.P..v.TKR.2.....x...2.._.W....\|]uH..9.Iv^...."..!y7C."L.&mz.T.G=.'%...Qt4...-/.c......X\|9....2..B....y..p.........\xQ.6..P.....3.D......4...Y.X....m..{.@..e...W...-..Wv....q.s.K...5....\H.Q.....c9.D...gB,C9(...U7O.&...YR...G.....:x.`......[...-.....i.K.G%~+bB....n. .._..?....^..Ou?e..Bw.&s.j..p>....-d..\|kua..L#v.%...0g}.szC..]....,.t....g.=..w...bP..\|....*....Mc.O7.!'...9F.....`.=.."...{3. ..0,.o.-SaI..G."..H..2.o..X..-.;..,.A.U+>.#E.....up9z.....P.b_^...S...g......m-x...H)$Q.-.}...G.(....7.Y~y..M.D..2.{.....F.o(....]..L..7..I.l:{.yJ>.Vz..!.%~...p@.C..~...e.gp......'.a..<@~.B.^.J...N[.yU. ?....._...DwP

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_3.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	9244
Entropy (8bit):	2.2735438202053193
Encrypted:	false
SSDEEP:	48:zXmnfcKkx4E7j8lJq8q6xxhmuLjZ8xKThx0l7FZyoa:mfrE7j+qaxhR6xEEyT
MD5:	6974333CC8B153D6AE7ECF8041959821
SHA1:	3FFB4088096F28E92CB45773629DFC080C3CD790
SHA-256:	A1F48153ECFF4146F9480824652BDF0733D0AE64CB8F8A2D89733272C5A9C316
SHA-512:	9B10F2EED687C44379A814FE78A0F281A317355FA42BA164BE02B546A06763EC94585325F3C83FA48B3ED23DAC32948E4464F4FFF335755BB37FFAD516F10B86
Malicious:	false
Preview:	....8%.Y..g[^...g.....m.k[.......Q...OY<G..}...]Qu.Q...:..pae.PV....L.....q.0.5.sU..r...x]A..2g.4...D...6S..!b..Z3..K...#....z.]Z!...K..2...j..74..4H....).R..K......7..c~.I.X9/[.S......8...o...X.............9.aA}&Bj}:....%J&...Y.'u.{....j'.K...#.V3........8S..Q..V...c..}..:.'g..'s....Nr.=7.%.s..\|0..N.....)16..D<I...g..Ws>f.o".y$.Lh.).,...8".8^16&+.E.:.@..p.b>.$#.......xY..0.Q%....Y....^.#....9.,U...eP<.j.C.o..LLvz.....]9f$...6......_.]...]'.TYAD.....X.1x!....;..)X.....P:.2..X.v.%.~..,.....2!{..a-. .\.abm.._-u....\|..u\j...]Dg.I.!.j...[<&.(.<......$o...FD6....\.._...xd}z^.GJ42]..!o..S+.Y\|....K....`..........].7d....\|.....T...:v.9.S.ii3....uc.A......KDM{..8.?.....Uo....{.jI....Q.* ...L./..D...<H..7...Prw._...x.....B.A..I.S6....rL....YB..).!2GTA.Z.N....+-.la...}."...R......................z:...V.H..E....b....D..v.K.].nP4a.b"..iN.j.u(?\|[4.. o.i..Wc...>.....j.66....z..b..7.>.!.(..s...8.,.N./W.J..W.l...t.,...`.Od.i.i......1/6..=[.F..>p...'....T

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\index.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	263564
Entropy (8bit):	1.3180980907680402
Encrypted:	false
SSDEEP:	768:bTMBaqu5dV5JDIRxY5Z+ISCVDIhvmmI2nPgvD9:b2aquBX55Z+7UIlFPgvD9
MD5:	E3AD6EC010FD50692EE6A633B3A02C4B
SHA1:	A0D100972CA994B136DC8C2A7E66C07B3B0AA365
SHA-256:	9C1EBC74DFCE9EE99D91DA268E56F35F4AE8A67BE745FBF03D424BFDE89ACE1D
SHA-512:	9FD7D0330AD8C7CC3FA375247C77E9DCC5AD7789416DD7451BB7F7A6684A2E76CE5A1E1FA0289C4DCC6A5FD0A16371D84D6C3B634BC9362C7DFDF40BA33D1791
Malicious:	false
Preview:	....8%.Y..g[^...........]..#\|H..q$Z......L..nf.u..5.e.w.m.Q1.i.8.c--vH..1...R'...c"...\4...w........CmM(..j...R,.zO{.............U.X.........k.+8..U]....]F..<.ON.t.....e.}..S..-".;...g...i.....q.:kS..P..j..b.@.X$m.....Z.;.7i...... K}d..fA..H..k.N-x......{f.P....N. 5.M.36..:.4...m.,.S.Y.,W;....S..@..VBJ.Kw#..O.o......n.r...r..1".1`(...S..e..Y..E...L.. ..r\|....4J.s.q.6.....r.TU...MU........Xq .M".D...p`.......+......RXrL......".6....Q.$..-E....y4a..#!..#.B......v.R.e......Q.Px.p9)...w..2.>.>."Hr...6.....2>.->....e.....x..B...a.0..M.`............%.%...E./'.H..hN.B*..q....G.3..y..by59eB..S.....=}!F4$.7T..#wR.y..j.7.3o..).t.;......Z..8...fY.c.Y...ro.a......_A......q..f.h.H...!1ya.?.FN0>W]..[.y..:...8..xq..<...O.L....Z.......>..`..&.7......\|.\|%@..#..v@.{..T..T..eC........s..^.T...js%.........T..R..._v...69..y...$....B...N.C]..9....2E.H)e.?\"...jW....nl.v.P6.[{.j....H.}.vL..]............M.u.........)e@V..#6....#...HN....T....r..

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	5.213750267267376
Encrypted:	false
SSDEEP:	24:8kagbG3pu0DMdNtXtHEFYHUQXrWI1SGjZ8xK0ChbFwBY47qsZiRvQmR:GgEs063muLjZ8xKThx0l7FZyoa
MD5:	9D8B850889A1B6FE078E8BD8EFF713A3
SHA1:	DCA5FF282A9C54ABCA60BEE320B6423F8D36B442
SHA-256:	C2DA380E7068AD5E7BCCC6AF9E87D3844438935D897D17DA74011A61F0DC5DEB
SHA-512:	9BC3B1CC05ED384C8D6E9479A2169B4355021283055E82438015620613EA08C0B329769C2CCC847672ADCA97051543DE66390A81053728A4FC8B365AF8158B44
Malicious:	false
Preview:	....8%.Y..g[^..K!.9\|#D...7.Wf.Ggi.. ...rr.@P....H.....r.........T.[.f..x.R..t.R..k...4Z.\..v.....M8....XI7..{...o7.....b..2.'.E7.:+M.iY.....`...D....x(j.hB+6&..3q.2+...a.....v.#.id...2..[R#...I.E.........V.D....-...G/..rO..^R...---8+8---810c672d36378df7ba66eb129f4c6bb01836f5290007420de8d202118e07b6c7dc38fac5a59c74080ea76bd12f2ef83bc30b1a748467f88702fd324119f7955872707b9682d9f03842ec38edf9796f7ee6b8ee7b8199151f36857aff31a2d1f8c22534a46a131caa4dac87a307589a65989ca5b0cdde11217475216802114a6767bd447c0c74d8725b0cbe9cf7956d3eb192dcf4d957f7ebfde06019d99a776dd7208f98652328a9c8fd1571fb4beecb4da6c1a49939c8a1b256c663471b47c02fb42fd5c6035c5b0d332d47c60bcbb53ed25e26894152dbbace1126ff70bcbb02dd7f98e8bf0a702dacd4513bf935403642c3086ad35dc18f743a1ed35902ed5611715bb42ee7138a79b79f69241ae1c8c9051dcb282bbd641f0288e62db59ae8d1ac8003a556bc67adc5e4550a0eac872589596bacf1bafa723b5b6ab9ddbe1c3f2ef0f9193715c8aa64352e1dc2b95e12372c42ef10b1ceb7433ac2dfba762675c6ff7cb80a9ac40f7ff8b8aa66d7fbe37c2f743f7

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	5.120820253218189
Encrypted:	false
SSDEEP:	24:nw3R3XtHEFYHUQXrWI1SGjZ8xK0ChbFwBY47qsZiRvQmR:nw3pmuLjZ8xKThx0l7FZyoa
MD5:	A5DA6D0ACCE53F92C14176B540C4341C
SHA1:	8BEEB62C888AC134D1BECEC869E57A66B133FB10
SHA-256:	D83046CB9139EFE3151DD013799F062B5DEF03B41B1BF920594F6543C567B257
SHA-512:	23144DDA5F8F9E2DE746FDF6ABE4213FBE742358C0556EF6192F6F2BEFBF4E297D388C6F8D13166F08C865C86C13D6BAAC7D7AA4BD37F5F86A47C3628D2FDB7B
Malicious:	false
Preview:	....8%.Y..g[^.........A.b%.V..3.-.M;V..\....>m.W:.H.....j;....p.[..j.y.4J.O.F...t.........7.!..!0.....-..../.......m:..;2..!.P ..jN..BUp.._C4.U...g.q.j......o.S.fTd...0.x.n.....R....j..?..s..0q....---8+8*---810c672d36378df7ba66eb129f4c6bb01836f5290007420de8d202118e07b6c7dc38fac5a59c74080ea76bd12f2ef83bc30b1a748467f88702fd324119f7955872707b9682d9f03842ec38edf9796f7ee6b8ee7b8199151f36857aff31a2d1f8c22534a46a131caa4dac87a307589a65989ca5b0cdde11217475216802114a6767bd447c0c74d8725b0cbe9cf7956d3eb192dcf4d957f7ebfde06019d99a776dd7208f98652328a9c8fd1571fb4beecb4da6c1a49939c8a1b256c663471b47c02fb42fd5c6035c5b0d332d47c60bcbb53ed25e26894152dbbace1126ff70bcbb02dd7f98e8bf0a702dacd4513bf935403642c3086ad35dc18f743a1ed35902ed5611715bb42ee7138a79b79f69241ae1c8c9051dcb282bbd641f0288e62db59ae8d1ac8003a556bc67adc5e4550a0eac872589596bacf1bafa723b5b6ab9ddbe1c3f2ef0f9193715c8aa64352e1dc2b95e12372c42ef10b1ceb7433ac2dfba762675c6ff7cb80a9ac40f7ff8b8aa66d7fbe37c2f743f7795998eb68fc4194a60899f690bfa66d

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1308
Entropy (8bit):	5.347988787168127
Encrypted:	false
SSDEEP:	24:VkVilgz7HEy7IRUXtHEFYHUQXrWI1SGjZ8xK0ChbFwBY47qsZiRvQmR:GViIHRI0muLjZ8xKThx0l7FZyoa
MD5:	6C6F8385C0CCD0EC076FFD814E4F1912
SHA1:	D01B499F38CACCBA2B7BB85FA0D30641C4A31493
SHA-256:	E0EA992955C45720D53E385476DF12D8D335BACD4D2556E365C85C3EF2F6844D
SHA-512:	1524D601C6EA6BEC16FA0B1612347849419A8A636C2CF4EAEA15867AFEAF2264BBB72156B5E128273C7D07364BAA6CFBCDFCAF2557E56D5E530E0CB999128BB8
Malicious:	false
Preview:	....8%.Y..g[^..:7J,h.h......aZ..j...`g@U...mx..9.5..Bj.\|.M\|...-.....5......,...y.GF!Q.q.)..G9?.d.....8......A.e.._..p.....q..z..~....eS..1.?YR.-..........a....?n..[.F.\|.....I..o..MiF.1/.3..]Ec..T....&......,.X..D.s..?.`.A....5....e..;.)..W.}.....=.?.k].N.&.1---8+8*---810c672d36378df7ba66eb129f4c6bb01836f5290007420de8d202118e07b6c7dc38fac5a59c74080ea76bd12f2ef83bc30b1a748467f88702fd324119f7955872707b9682d9f03842ec38edf9796f7ee6b8ee7b8199151f36857aff31a2d1f8c22534a46a131caa4dac87a307589a65989ca5b0cdde11217475216802114a6767bd447c0c74d8725b0cbe9cf7956d3eb192dcf4d957f7ebfde06019d99a776dd7208f98652328a9c8fd1571fb4beecb4da6c1a49939c8a1b256c663471b47c02fb42fd5c6035c5b0d332d47c60bcbb53ed25e26894152dbbace1126ff70bcbb02dd7f98e8bf0a702dacd4513bf935403642c3086ad35dc18f743a1ed35902ed5611715bb42ee7138a79b79f69241ae1c8c9051dcb282bbd641f0288e62db59ae8d1ac8003a556bc67adc5e4550a0eac872589596bacf1bafa723b5b6ab9ddbe1c3f2ef0f9193715c8aa64352e1dc2b95e12372c42ef10b1ceb7433ac2dfba762675c6ff7cb80

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	5.2494711822061495
Encrypted:	false
SSDEEP:	24:zSp/S/HHV3XtHEFYHUQXrWI1SGjZ8xK0ChbFwBY47qsZiRvQmR:UaPHRmuLjZ8xKThx0l7FZyoa
MD5:	193E61221671B61021796668A9086A1A
SHA1:	FF0ECC35B190BB5ECCF0592651C9BE572181AE5E
SHA-256:	DE580FCB785F70341B5B4CCB2A0AADE55A72EF9D58834BC6BD20EDE236FDF80F
SHA-512:	903FF98B4597D47E7109653DC68BA7FDA30A1202C0D0AFFCF54A21893B6368EA69782EFAE3095FF28EA497FF4A25DB287A58B60985A7CFB2C7BA6229C8066827
Malicious:	false
Preview:	....8%.Y..g[^.....8o.7j....j]...as.z\.m.2....k....~........y/r...;..RAN.,u.Ny.9L...k./.....n.?.U..kkh.D.eT....V.`..............Q.ux.P......(..x#.~.P.AAaH.f..?...}b...4_..V.[ ....Z....^.u...9....y.:F..Eva..q>...hB.#U~.'...}$y.Y?5---8+8*---810c672d36378df7ba66eb129f4c6bb01836f5290007420de8d202118e07b6c7dc38fac5a59c74080ea76bd12f2ef83bc30b1a748467f88702fd324119f7955872707b9682d9f03842ec38edf9796f7ee6b8ee7b8199151f36857aff31a2d1f8c22534a46a131caa4dac87a307589a65989ca5b0cdde11217475216802114a6767bd447c0c74d8725b0cbe9cf7956d3eb192dcf4d957f7ebfde06019d99a776dd7208f98652328a9c8fd1571fb4beecb4da6c1a49939c8a1b256c663471b47c02fb42fd5c6035c5b0d332d47c60bcbb53ed25e26894152dbbace1126ff70bcbb02dd7f98e8bf0a702dacd4513bf935403642c3086ad35dc18f743a1ed35902ed5611715bb42ee7138a79b79f69241ae1c8c9051dcb282bbd641f0288e62db59ae8d1ac8003a556bc67adc5e4550a0eac872589596bacf1bafa723b5b6ab9ddbe1c3f2ef0f9193715c8aa64352e1dc2b95e12372c42ef10b1ceb7433ac2dfba762675c6ff7cb80a9ac40f7ff8b8aa66d7fbe37c2f743f7

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	5.2363783148590395
Encrypted:	false
SSDEEP:	24:v5pRkveXtHEFYHUQXrWI1SGjZ8xK0ChbFwBY47qsZiRvQmR:BMMmuLjZ8xKThx0l7FZyoa
MD5:	A646966797C83ADAD8CE6D5B586B73FB
SHA1:	70B7AA432FCD4C9170632334046E818E19FFD816
SHA-256:	C812386C0F58287F7796EE5AC42F4A637E020A70E7692B734325689B82183005
SHA-512:	C404996A2F6C19A0174DF893ABB70878A8A8BED8EAFC29EC01858E884B737C912AB9374A235C7D5DA0393DA559A49A0C0653B4ABF941E9A9C972B4962BF047AF
Malicious:	false
Preview:	....8%.Y..g[^.../.8..1...qZ.;.w.wj.....f#KZg.o2..~<@.ER r..,...5...e.w.....v....(A.D..R.....2!..p.\.e.4..t....k]OY..$r.c.x.`...hy{.\.@,b...._.'.W.P.\...R.[...VY..Z.Ud..y....M.......y.....%...V...j......R..(vZR....a..... .---8+8*---810c672d36378df7ba66eb129f4c6bb01836f5290007420de8d202118e07b6c7dc38fac5a59c74080ea76bd12f2ef83bc30b1a748467f88702fd324119f7955872707b9682d9f03842ec38edf9796f7ee6b8ee7b8199151f36857aff31a2d1f8c22534a46a131caa4dac87a307589a65989ca5b0cdde11217475216802114a6767bd447c0c74d8725b0cbe9cf7956d3eb192dcf4d957f7ebfde06019d99a776dd7208f98652328a9c8fd1571fb4beecb4da6c1a49939c8a1b256c663471b47c02fb42fd5c6035c5b0d332d47c60bcbb53ed25e26894152dbbace1126ff70bcbb02dd7f98e8bf0a702dacd4513bf935403642c3086ad35dc18f743a1ed35902ed5611715bb42ee7138a79b79f69241ae1c8c9051dcb282bbd641f0288e62db59ae8d1ac8003a556bc67adc5e4550a0eac872589596bacf1bafa723b5b6ab9ddbe1c3f2ef0f9193715c8aa64352e1dc2b95e12372c42ef10b1ceb7433ac2dfba762675c6ff7cb80a9ac40f7ff8b8aa66d7fbe37c2f743f7

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	5.212954784777058
Encrypted:	false
SSDEEP:	24:fioHHoIKWYO1ueu8kr9pA7QACGTkTQtJZMBTiThgUNbggXEUZYME2R:pnZButNUjC0kTQzZcsSUWeR
MD5:	32E01E3BBA88F974370BDF3463C9B910
SHA1:	AD89C60C2CBE8EBD0DD1FC94FA04BDEFE0054843
SHA-256:	F6632EC60A7FF03814CDC0A94FD282CBE89E74B4EDEC8B9869BEE5BB26F31C94
SHA-512:	3313EA2C1C4CF3EA575EC08516BACD3832B50580B65775AF5960E33D898ED140F57B916BA3945107DCBC0EAC06D749A32F6B3B5832C7604DD269E662DEF8B6EF
Malicious:	false
Preview:	.am.q.Zg.o..-..v:.......21<b.c.@.[....n..(...viw...^.....T^1A..F~..y...p..6.a.2.QG..l~?.%...7..$.lX....N.....q.P......?.....{O.a.8......b...K.....K./B...e;Qy.........sp....@..e...C.%/....#&GA.39.3..7.5)..$...J....J...&...O...---8+8---27178735a11efb70e6b0273f52aae19386caffe3510f48c660cd5dc8a30c7b4f3391dad568d50ef0aeb45cc106d54c9d21f959a4087af817cb18b1509c2e6ff9318da282eaa42a54830d8d97ca8bdb12d8660f1e1dfe1655a4b6d507671c5e970223a07f6f1c2ff3ed8bbe93ca23f341504ddff4c68702c09d82e6d96f23c1467b95b34421459c1ea99a00ce8fdb202f2b43cc4fbb011a545adfe1e4f62e5a1b299cd8c9e5658d5a1265c8ecdc3525a6dd5d33bf48c7b7d7f628c0684939dcd896b6611f5d2d245a5a53a50c7b6848eea2af89d5a37baccb477ae340b5acc427161a878d665b6c55ae76110846cba8a88f88bdc2f1a1c6fdaf8b2ed227d09db819ea7e27a3250aceaa3f18c3ae6e7ea570368fd8843d03d2af2c12d6898a8c7c7682eabb8b244fc132d977bc72bca23fde3c6745f05432ec8ca41c7c931c30fa2ffaaf926040ca809eea7504bcdc8ecf41005321cc6d1d88809173428dc3695039e8cfeb5e224331f73133de8b7bd8d7801a1dafb0c0b

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	5.113386300467213
Encrypted:	false
SSDEEP:	24:fiJFyhrHCr0GNIU1ueu8kr9pA7QACGTkTQtJZMBTiThgUNbggXEUZYME2R:0yhjRYIU1utNUjC0kTQzZcsSUWeR
MD5:	5699E3FD51EBDC715184459551DCAD26
SHA1:	14C4239219C0E21B6551ABBC282E2FCE90DFEBEF
SHA-256:	89C0AEF61BB93A8C629AE0C3A6ECD55B819B75F3A320D1D349181DEFA0FECAC4
SHA-512:	9C9537FB5C43CFE333C92BFFC9A54C2ADE447A8E8E43BA66D7E7B7E912774E81270C72A1D3D4E10EDA935FBE513C60CCC2AF8C8C5C593B7A77082A7035FBC9AF
Malicious:	false
Preview:	.am.q.Zg.o..-..vj.....i...Bu.r...5L..+...).x.Pu.IA........S...:.Y....i..c.T..:.Rq..a.....e..<c..l...z..d.0.;...T.N....G...........r.$L..B5;J .O..0{v..g ..P0k@gS.{_....kI8...v..._q....r...3....Kl.---8+8---27178735a11efb70e6b0273f52aae19386caffe3510f48c660cd5dc8a30c7b4f3391dad568d50ef0aeb45cc106d54c9d21f959a4087af817cb18b1509c2e6ff9318da282eaa42a54830d8d97ca8bdb12d8660f1e1dfe1655a4b6d507671c5e970223a07f6f1c2ff3ed8bbe93ca23f341504ddff4c68702c09d82e6d96f23c1467b95b34421459c1ea99a00ce8fdb202f2b43cc4fbb011a545adfe1e4f62e5a1b299cd8c9e5658d5a1265c8ecdc3525a6dd5d33bf48c7b7d7f628c0684939dcd896b6611f5d2d245a5a53a50c7b6848eea2af89d5a37baccb477ae340b5acc427161a878d665b6c55ae76110846cba8a88f88bdc2f1a1c6fdaf8b2ed227d09db819ea7e27a3250aceaa3f18c3ae6e7ea570368fd8843d03d2af2c12d6898a8c7c7682eabb8b244fc132d977bc72bca23fde3c6745f05432ec8ca41c7c931c30fa2ffaaf926040ca809eea7504bcdc8ecf41005321cc6d1d88809173428dc3695039e8cfeb5e224331f73133de8b7bd8d7801a1dafb0c0b15a1d223dcb094f306c5d2f345a01f75

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	5.104770778618734
Encrypted:	false
SSDEEP:	24:fihXr11ueu8kr9pA7QACGTkTQtJZMBTiThgUNbggXEUZYME2R:Kb11utNUjC0kTQzZcsSUWeR
MD5:	7C15604A6F83EF72481A30C06030F9AD
SHA1:	0BA75DC69869E4BAE52CE757BF088403EFD60957
SHA-256:	329EE362A43E2CC393A9A32F3CB8EAAC3458FB8586714648F3C59B55600A6587
SHA-512:	F0C917245356EA64AA40828494E8F1C63C4632DD6995BDCFF006A90A7785EF563174A3A57E40D342405EEF3AF16566F9993BBA8A3B39B7680097B4825507FAD1
Malicious:	false
Preview:	.am.q.Zg.o..-..v..Y..~SZ.....>j.31..tg.\|D.M....=.o.AW8..K0.M.....J.Z..R..\._z$.I.t.3)..Y.E...."d.\.....g..Ko......7...n..8.q.r..x..^..%o.P...N.]-.d.]...N..i...g.......y.D..3#LO...Et.%%pcDD.{....a...---8+8---27178735a11efb70e6b0273f52aae19386caffe3510f48c660cd5dc8a30c7b4f3391dad568d50ef0aeb45cc106d54c9d21f959a4087af817cb18b1509c2e6ff9318da282eaa42a54830d8d97ca8bdb12d8660f1e1dfe1655a4b6d507671c5e970223a07f6f1c2ff3ed8bbe93ca23f341504ddff4c68702c09d82e6d96f23c1467b95b34421459c1ea99a00ce8fdb202f2b43cc4fbb011a545adfe1e4f62e5a1b299cd8c9e5658d5a1265c8ecdc3525a6dd5d33bf48c7b7d7f628c0684939dcd896b6611f5d2d245a5a53a50c7b6848eea2af89d5a37baccb477ae340b5acc427161a878d665b6c55ae76110846cba8a88f88bdc2f1a1c6fdaf8b2ed227d09db819ea7e27a3250aceaa3f18c3ae6e7ea570368fd8843d03d2af2c12d6898a8c7c7682eabb8b244fc132d977bc72bca23fde3c6745f05432ec8ca41c7c931c30fa2ffaaf926040ca809eea7504bcdc8ecf41005321cc6d1d88809173428dc3695039e8cfeb5e224331f73133de8b7bd8d7801a1dafb0c0b15a1d223dcb094f306c5d2f345a01f75

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4ca3cb58378aaa3f_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	5.2401023910013205
Encrypted:	false
SSDEEP:	24:fi5Ncgi00PB2Xueu8kr9pA7QACGTkTQtJZMBTiThgUNbggXEUZYME2R:imgJYqutNUjC0kTQzZcsSUWeR
MD5:	9EBEC9532109BEF70BE7B662D72EEA05
SHA1:	3627A7C8B314A7C17A76F12B4796E327BB5C0D3A
SHA-256:	57ADF2F5B706DA159268724C21FA752C37448E0CB5BC825042AFA4F93BED6E20
SHA-512:	306657C2694CD9DCA173E21FB10989F571954237A69CC42533CDBCB394602BAD4E92F20D913CF572814E4852DBC971C5347FE9C800B1AF6A2153A71DE85F462B
Malicious:	false
Preview:	.am.q.Zg.o..-..v....jG...X....O....=..0c4".~...\|\T.T.gA}.....w.....YU.4w....5...6. #...'....:.=..j.oT..<w.9i...k..$e...hi......q.......m..E...z..$.....zl..s.U....<......M,...].....I'......\|.........4.'....._X.S.jL7.3.v.....a-...---8+8*---27178735a11efb70e6b0273f52aae19386caffe3510f48c660cd5dc8a30c7b4f3391dad568d50ef0aeb45cc106d54c9d21f959a4087af817cb18b1509c2e6ff9318da282eaa42a54830d8d97ca8bdb12d8660f1e1dfe1655a4b6d507671c5e970223a07f6f1c2ff3ed8bbe93ca23f341504ddff4c68702c09d82e6d96f23c1467b95b34421459c1ea99a00ce8fdb202f2b43cc4fbb011a545adfe1e4f62e5a1b299cd8c9e5658d5a1265c8ecdc3525a6dd5d33bf48c7b7d7f628c0684939dcd896b6611f5d2d245a5a53a50c7b6848eea2af89d5a37baccb477ae340b5acc427161a878d665b6c55ae76110846cba8a88f88bdc2f1a1c6fdaf8b2ed227d09db819ea7e27a3250aceaa3f18c3ae6e7ea570368fd8843d03d2af2c12d6898a8c7c7682eabb8b244fc132d977bc72bca23fde3c6745f05432ec8ca41c7c931c30fa2ffaaf926040ca809eea7504bcdc8ecf41005321cc6d1d88809173428dc3695039e8cfeb5e224331f73133de8b7bd8d7801a1dafb0c0b

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	5.129773013548777
Encrypted:	false
SSDEEP:	24:fioKc/CwDAM/ueu8kr9pA7QACGTkTQtJZMBTiThgUNbggXEUZYME2R:IOn/utNUjC0kTQzZcsSUWeR
MD5:	75ACDBFD30B5E9FA8FEB98EB1882376D
SHA1:	5A1978EEE9813118E00C0A2EE6A2750C811B8F85
SHA-256:	5CD186ABE10F76BADA53BD87A005458C3D098DAD862CF27C94646BC88084FC75
SHA-512:	716BF6A5F523CF676748A7CA4436075E9B1FC142E4F6D4D995E36414C39A75A8BD6A58FFE27F3A6BCFEF4BA19C1AA25084E95DD0F4399CEAFBA5247A39D1E7D6
Malicious:	false
Preview:	.am.q.Zg.o..-..v.?'E.V4wukmI/.m.....xC..w?...........+3.c...B.y....4.o.......#.^.0./.....2.._Z.,0..U..S5.`.)Ly.O....K.W......;.\|....A......5..#.r.v.G..dVU.....6.r..{.[..U.;...@...g....T....PX.RF..:$---8+8---27178735a11efb70e6b0273f52aae19386caffe3510f48c660cd5dc8a30c7b4f3391dad568d50ef0aeb45cc106d54c9d21f959a4087af817cb18b1509c2e6ff9318da282eaa42a54830d8d97ca8bdb12d8660f1e1dfe1655a4b6d507671c5e970223a07f6f1c2ff3ed8bbe93ca23f341504ddff4c68702c09d82e6d96f23c1467b95b34421459c1ea99a00ce8fdb202f2b43cc4fbb011a545adfe1e4f62e5a1b299cd8c9e5658d5a1265c8ecdc3525a6dd5d33bf48c7b7d7f628c0684939dcd896b6611f5d2d245a5a53a50c7b6848eea2af89d5a37baccb477ae340b5acc427161a878d665b6c55ae76110846cba8a88f88bdc2f1a1c6fdaf8b2ed227d09db819ea7e27a3250aceaa3f18c3ae6e7ea570368fd8843d03d2af2c12d6898a8c7c7682eabb8b244fc132d977bc72bca23fde3c6745f05432ec8ca41c7c931c30fa2ffaaf926040ca809eea7504bcdc8ecf41005321cc6d1d88809173428dc3695039e8cfeb5e224331f73133de8b7bd8d7801a1dafb0c0b15a1d223dcb094f306c5d2f345a01f75

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1308
Entropy (8bit):	5.342359622342813
Encrypted:	false
SSDEEP:	24:fiqdvvNnUwExWujXV+stueu8kr9pA7QACGTkTQtJZMBTiThgUNbggXEUZYME2R:DnFYHYUutNUjC0kTQzZcsSUWeR
MD5:	CBD57285890D3D871BE23157F5F18A26
SHA1:	88281793F499B9C15AB1EFED0565AFE0BC2DBC22
SHA-256:	2324319AE9DE16E3DF02721BDB0AA195D7810A46FC9285EE27E6C19B5A396821
SHA-512:	8F414E1CFBA821968586A2AAB1F7E2C70BB4F388D05D43AC8C3238D2CE10BF7510AE0ED9D9C3D9CF08D7ABE99A05EA0792DAC2DCFA37461FC55B81C8D51FE896
Malicious:	false
Preview:	.am.q.Zg.o..-..v......j{..Ffy],d.. Ie.3..{R...~.Im....5._...].@..mp....kb.A..a..:...oe{..k....\. .q...,%,O.........j.6....c.Z.&..(.....?...f..0.......\|R..a<....'..;.z.~Q}......H..q..0..r.fM9Q......./....R...i........A..V..~.6R.....#V.....[j\...%.]!W[.Ll.9...---8+8*---27178735a11efb70e6b0273f52aae19386caffe3510f48c660cd5dc8a30c7b4f3391dad568d50ef0aeb45cc106d54c9d21f959a4087af817cb18b1509c2e6ff9318da282eaa42a54830d8d97ca8bdb12d8660f1e1dfe1655a4b6d507671c5e970223a07f6f1c2ff3ed8bbe93ca23f341504ddff4c68702c09d82e6d96f23c1467b95b34421459c1ea99a00ce8fdb202f2b43cc4fbb011a545adfe1e4f62e5a1b299cd8c9e5658d5a1265c8ecdc3525a6dd5d33bf48c7b7d7f628c0684939dcd896b6611f5d2d245a5a53a50c7b6848eea2af89d5a37baccb477ae340b5acc427161a878d665b6c55ae76110846cba8a88f88bdc2f1a1c6fdaf8b2ed227d09db819ea7e27a3250aceaa3f18c3ae6e7ea570368fd8843d03d2af2c12d6898a8c7c7682eabb8b244fc132d977bc72bca23fde3c6745f05432ec8ca41c7c931c30fa2ffaaf926040ca809eea7504bcdc8ecf41005321cc6d1d88809173428dc3695039e8cfeb5e224

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	5.2341339164331275
Encrypted:	false
SSDEEP:	24:fi52hQUkcxzXUnfueu8kr9pA7QACGTkTQtJZMBTiThgUNbggXEUZYME2R:i2+A7EutNUjC0kTQzZcsSUWeR
MD5:	272649B1C4912402BB84AB73C61E56CC
SHA1:	81808D1B06E7F186110085D6F91F4595C66F6AD7
SHA-256:	A5CBD5E15DCB6B788BE397ABE944BE2378848BB6A3F6410040DB192521A087A1
SHA-512:	087304A17F193A569E337EF524A6CDB4CED835017DDA0F756B740E5AE375C2C2405AFDE2E2C4174D5B189779FD11D17281812C462A06E8506C409EC3885511B8
Malicious:	false
Preview:	.am.q.Zg.o..-..v....jG...X.....pL(b.......D'\|g...)..;.[.I.....]C{..f.4E...1.M(.&..6.sa...W...%)k..Kr.........N...D.spsD-j...7....#G?H....7.n.%X.(j.aW.v@.]..ML.WG..\|..Vo..W<.9G.K...{....z.V.`.v...L.nG.)........@.\|V.....J.......---8+8---27178735a11efb70e6b0273f52aae19386caffe3510f48c660cd5dc8a30c7b4f3391dad568d50ef0aeb45cc106d54c9d21f959a4087af817cb18b1509c2e6ff9318da282eaa42a54830d8d97ca8bdb12d8660f1e1dfe1655a4b6d507671c5e970223a07f6f1c2ff3ed8bbe93ca23f341504ddff4c68702c09d82e6d96f23c1467b95b34421459c1ea99a00ce8fdb202f2b43cc4fbb011a545adfe1e4f62e5a1b299cd8c9e5658d5a1265c8ecdc3525a6dd5d33bf48c7b7d7f628c0684939dcd896b6611f5d2d245a5a53a50c7b6848eea2af89d5a37baccb477ae340b5acc427161a878d665b6c55ae76110846cba8a88f88bdc2f1a1c6fdaf8b2ed227d09db819ea7e27a3250aceaa3f18c3ae6e7ea570368fd8843d03d2af2c12d6898a8c7c7682eabb8b244fc132d977bc72bca23fde3c6745f05432ec8ca41c7c931c30fa2ffaaf926040ca809eea7504bcdc8ecf41005321cc6d1d88809173428dc3695039e8cfeb5e224331f73133de8b7bd8d7801a1dafb0c0b

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1260
Entropy (8bit):	5.149934544405498
Encrypted:	false
SSDEEP:	24:fi7IuMQOk9ueu8kr9pA7QACGTkTQtJZMBTiThgUNbggXEUZYME2R:8MQv9utNUjC0kTQzZcsSUWeR
MD5:	FBEFDA1385F3471607F5BAA5179EBA2B
SHA1:	3066179AC111A9ACFBB4329A520EB9A752316E87
SHA-256:	E4A21A2238CD6184828C652906934310573ECF58DB7240879D8C82008AFA1C35
SHA-512:	A8A79BACE9AA48ECAC2D4B8E9FC7155FFABEBF96280A4A8681C3F745094ACCDDB3119E685B9605976380E49D2EB874625E11A77F104CCE2AF555142A746ED409
Malicious:	false
Preview:	.am.q.Zg.o..-..v.?...c}H.z.2...mb..>[AP.o).O5.RK.e_b.U..Ik.Ycm...1Y\|....B...`2.#%.).l....>...&A5.....].Hp.....b.9....~X....!. ..r..</..K...9#./yy..M(S2......!.....%5.e;..{....W......Bw..q5;.z....0l....[..<.]8..n.2.---8+8---27178735a11efb70e6b0273f52aae19386caffe3510f48c660cd5dc8a30c7b4f3391dad568d50ef0aeb45cc106d54c9d21f959a4087af817cb18b1509c2e6ff9318da282eaa42a54830d8d97ca8bdb12d8660f1e1dfe1655a4b6d507671c5e970223a07f6f1c2ff3ed8bbe93ca23f341504ddff4c68702c09d82e6d96f23c1467b95b34421459c1ea99a00ce8fdb202f2b43cc4fbb011a545adfe1e4f62e5a1b299cd8c9e5658d5a1265c8ecdc3525a6dd5d33bf48c7b7d7f628c0684939dcd896b6611f5d2d245a5a53a50c7b6848eea2af89d5a37baccb477ae340b5acc427161a878d665b6c55ae76110846cba8a88f88bdc2f1a1c6fdaf8b2ed227d09db819ea7e27a3250aceaa3f18c3ae6e7ea570368fd8843d03d2af2c12d6898a8c7c7682eabb8b244fc132d977bc72bca23fde3c6745f05432ec8ca41c7c931c30fa2ffaaf926040ca809eea7504bcdc8ecf41005321cc6d1d88809173428dc3695039e8cfeb5e224331f73133de8b7bd8d7801a1dafb0c0b15a1d223dcb094f3

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	5.21892946133469
Encrypted:	false
SSDEEP:	24:fi5P87DMtrJ69ueu8kr9pA7QACGTkTQtJZMBTiThgUNbggXEUZYME2R:iuMtVMutNUjC0kTQzZcsSUWeR
MD5:	24C27BCA25C02A1F980B2F4A49213DD7
SHA1:	A733D0D1410295E5FA01E705CEDD48235D2EE689
SHA-256:	5AE353E521A774E8DC2B05086C604D18CE0EAAB608F9F126A4257ED9A25361EC
SHA-512:	39854B7A98DF4F66E843759AA1E4538B5C3B2753309E1C20537EE4E14505E8C89C083786CDDABE2F3D5A9C16F6B617E754F4D1648ACBB250790B9FAFB6B6CE0D
Malicious:	false
Preview:	.am.q.Zg.o..-..v....jG...X........5..g.7.....T..../.q...B,..v....\(.6..q...].x.~.h..b...v..Jg.Au7C.<...s4d}.\j..f'Z. ....A..L....F9.;fwW...p......c.n...k......!?....-.8.f.a(...".U.....x..:[..P./$h)..W^.T$/R'W).8..,...da..]---8+8*---27178735a11efb70e6b0273f52aae19386caffe3510f48c660cd5dc8a30c7b4f3391dad568d50ef0aeb45cc106d54c9d21f959a4087af817cb18b1509c2e6ff9318da282eaa42a54830d8d97ca8bdb12d8660f1e1dfe1655a4b6d507671c5e970223a07f6f1c2ff3ed8bbe93ca23f341504ddff4c68702c09d82e6d96f23c1467b95b34421459c1ea99a00ce8fdb202f2b43cc4fbb011a545adfe1e4f62e5a1b299cd8c9e5658d5a1265c8ecdc3525a6dd5d33bf48c7b7d7f628c0684939dcd896b6611f5d2d245a5a53a50c7b6848eea2af89d5a37baccb477ae340b5acc427161a878d665b6c55ae76110846cba8a88f88bdc2f1a1c6fdaf8b2ed227d09db819ea7e27a3250aceaa3f18c3ae6e7ea570368fd8843d03d2af2c12d6898a8c7c7682eabb8b244fc132d977bc72bca23fde3c6745f05432ec8ca41c7c931c30fa2ffaaf926040ca809eea7504bcdc8ecf41005321cc6d1d88809173428dc3695039e8cfeb5e224331f73133de8b7bd8d7801a1dafb0c0b

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\72d9f526d2e2e7c8_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1292
Entropy (8bit):	5.292985784768164
Encrypted:	false
SSDEEP:	24:ficcCIw5rztZ1c8nueu8kr9pA7QACGTkTQtJZMBTiThgUNbggXEUZYME2R:lcCDp/cgutNUjC0kTQzZcsSUWeR
MD5:	8F9B948A72D5C60D2D3EC5AE43C3A56A
SHA1:	77C7C2A0C5CDDAE91AE1516CEBF1D887F7CC49C7
SHA-256:	331B542AEDD96E33980A2A46C7A6ADACB80C9BC77FAD984ADE574A1CF8F7DD12
SHA-512:	35453DC8FB8D4F143E1D1AC506B9B7B1BF99BE5976C5B0E7910DCC865336405B0C3C74A38E622FEF78506756D8D5EF675AC29CAB2F23F05AE8C3F073235A8888
Malicious:	false
Preview:	.am.q.Zg.o..-..vaF......f/9..G}....;Y..z..X..4.gp../.....'..%.e..5@J..:<..............[E..?....?g.j.x.et...1..X.....:k...y....!......V7.Y...@.....Y. M..U9j,.;. 6F.........u..0.TC.\....s..1.~...).......K..]...bd.l..........q.. `...(...W..].7.Q.---8+8---27178735a11efb70e6b0273f52aae19386caffe3510f48c660cd5dc8a30c7b4f3391dad568d50ef0aeb45cc106d54c9d21f959a4087af817cb18b1509c2e6ff9318da282eaa42a54830d8d97ca8bdb12d8660f1e1dfe1655a4b6d507671c5e970223a07f6f1c2ff3ed8bbe93ca23f341504ddff4c68702c09d82e6d96f23c1467b95b34421459c1ea99a00ce8fdb202f2b43cc4fbb011a545adfe1e4f62e5a1b299cd8c9e5658d5a1265c8ecdc3525a6dd5d33bf48c7b7d7f628c0684939dcd896b6611f5d2d245a5a53a50c7b6848eea2af89d5a37baccb477ae340b5acc427161a878d665b6c55ae76110846cba8a88f88bdc2f1a1c6fdaf8b2ed227d09db819ea7e27a3250aceaa3f18c3ae6e7ea570368fd8843d03d2af2c12d6898a8c7c7682eabb8b244fc132d977bc72bca23fde3c6745f05432ec8ca41c7c931c30fa2ffaaf926040ca809eea7504bcdc8ecf41005321cc6d1d88809173428dc3695039e8cfeb5e224331f73133de8b7bd

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\78bff3512887b83d_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	5.256580057544074
Encrypted:	false
SSDEEP:	24:fibxYhW28sHobS5+pdrtueu8kr9pA7QACGTkTQtJZMBTiThgUNbggXEUZYME2R:GYF8srUdrtutNUjC0kTQzZcsSUWeR
MD5:	8CA1A0E49C21B7A0FB2F577F126EB516
SHA1:	9BD911C92279AECC07BB34975F36F2823F271056
SHA-256:	B273D7A811487DADE3EE85A4C351F85385B14300118717162A81D5E01604F05B
SHA-512:	244A6828FB9457A1956F94843E6969193582886000BF0D150DA2C40B92F0F77FB928D2B696CCA81F94A789DA9B5101D280A68D1DB6396DD8D281F16C6ADEE879
Malicious:	false
Preview:	.am.q.Zg.o..-..vTFc.M;..X...1"i..2......O.=.t............x....5@?........zt!......r.u..4$8.&}n&..'.fq...Q...v/..Cl.^..o...v.wJ.Jz.e...~jv#_.L.........m.....AG..A.4...M..S.......:\.5...5.?i..v..NO<.`J.....S..Q..S.U.........---8+8*---27178735a11efb70e6b0273f52aae19386caffe3510f48c660cd5dc8a30c7b4f3391dad568d50ef0aeb45cc106d54c9d21f959a4087af817cb18b1509c2e6ff9318da282eaa42a54830d8d97ca8bdb12d8660f1e1dfe1655a4b6d507671c5e970223a07f6f1c2ff3ed8bbe93ca23f341504ddff4c68702c09d82e6d96f23c1467b95b34421459c1ea99a00ce8fdb202f2b43cc4fbb011a545adfe1e4f62e5a1b299cd8c9e5658d5a1265c8ecdc3525a6dd5d33bf48c7b7d7f628c0684939dcd896b6611f5d2d245a5a53a50c7b6848eea2af89d5a37baccb477ae340b5acc427161a878d665b6c55ae76110846cba8a88f88bdc2f1a1c6fdaf8b2ed227d09db819ea7e27a3250aceaa3f18c3ae6e7ea570368fd8843d03d2af2c12d6898a8c7c7682eabb8b244fc132d977bc72bca23fde3c6745f05432ec8ca41c7c931c30fa2ffaaf926040ca809eea7504bcdc8ecf41005321cc6d1d88809173428dc3695039e8cfeb5e224331f73133de8b7bd8d7801a1dafb0c0b

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	5.2680499516955175
Encrypted:	false
SSDEEP:	24:fijKGqpZefmueu8kr9pA7QACGTkTQtJZMBTiThgUNbggXEUZYME2R:P9utNUjC0kTQzZcsSUWeR
MD5:	21C4390E7B966A400CB67CBBB7D00F4F
SHA1:	1F85155D9F0D97227022212EBEF3C2DF6BD5F8FA
SHA-256:	A5E7AE8FB28724E2DB1E1D0A903F18F537B3C1C3B1AE0328F2FF44266E16EE9F
SHA-512:	779280589785EFFB538AC0C2EBFE1ED094C093E11C41685A0C3E5B5CE2CE091D96D5996F7B69DEE5C7443D829519E8C943EEFBAF12685FA84C582CB61B63D104
Malicious:	false
Preview:	.am.q.Zg.o..-..v....G...D.&v.n.s.......D......7...p/..H.jp.j.5^.)...2...a..[C.....=V5..9...hh.-..M..kshF.O..,.J~.p_K....:.0U.w2...)Z..(..o..~Ev(..z......UK..x..u..a...x.@.G.D.Z......>.y'..e.....O.:...>.........:...L...h?`..${/"o.---8+8*---27178735a11efb70e6b0273f52aae19386caffe3510f48c660cd5dc8a30c7b4f3391dad568d50ef0aeb45cc106d54c9d21f959a4087af817cb18b1509c2e6ff9318da282eaa42a54830d8d97ca8bdb12d8660f1e1dfe1655a4b6d507671c5e970223a07f6f1c2ff3ed8bbe93ca23f341504ddff4c68702c09d82e6d96f23c1467b95b34421459c1ea99a00ce8fdb202f2b43cc4fbb011a545adfe1e4f62e5a1b299cd8c9e5658d5a1265c8ecdc3525a6dd5d33bf48c7b7d7f628c0684939dcd896b6611f5d2d245a5a53a50c7b6848eea2af89d5a37baccb477ae340b5acc427161a878d665b6c55ae76110846cba8a88f88bdc2f1a1c6fdaf8b2ed227d09db819ea7e27a3250aceaa3f18c3ae6e7ea570368fd8843d03d2af2c12d6898a8c7c7682eabb8b244fc132d977bc72bca23fde3c6745f05432ec8ca41c7c931c30fa2ffaaf926040ca809eea7504bcdc8ecf41005321cc6d1d88809173428dc3695039e8cfeb5e224331f73133de8b7bd8d7801a1dafb0c0b

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c159cc5880890bc_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	5.243014971090293
Encrypted:	false
SSDEEP:	24:fi7Eynai6k5jNLkueu8kr9pA7QACGTkTQtJZMBTiThgUNbggXEUZYME2R:s/ncAjNAutNUjC0kTQzZcsSUWeR
MD5:	4DD24233D18CFB7CEA31B0F86F6B59AD
SHA1:	BA59C1E59159803390A05BE34371E150867C77F5
SHA-256:	006FCB73E5B3E9F681748D022EC51576E8D19C5FCBC90B7E77F78DCFC2729945
SHA-512:	0F5DF03BDF164055A3D445CA8F51855D09CC9E958CB8D059D8E952C68871CBE35EADB4F10F5499A7617EC2D2AD09385EE77C420689A8D7BAB10BB80667352184
Malicious:	false
Preview:	.am.q.Zg.o..-..v.RB.......f u..f.....L.h....7e...sR..!V.}.......c..b.RA1...q..!?..'......../....f..pc.y.=.....?.i&!...b.s..\|..].j......U.P.F?.[..M\|....M..N.[.x..t..]g...t...J.E.H.....5..~.1.....(....\|j.Y)..3W..p..\|@e.........[$p.---8+8---27178735a11efb70e6b0273f52aae19386caffe3510f48c660cd5dc8a30c7b4f3391dad568d50ef0aeb45cc106d54c9d21f959a4087af817cb18b1509c2e6ff9318da282eaa42a54830d8d97ca8bdb12d8660f1e1dfe1655a4b6d507671c5e970223a07f6f1c2ff3ed8bbe93ca23f341504ddff4c68702c09d82e6d96f23c1467b95b34421459c1ea99a00ce8fdb202f2b43cc4fbb011a545adfe1e4f62e5a1b299cd8c9e5658d5a1265c8ecdc3525a6dd5d33bf48c7b7d7f628c0684939dcd896b6611f5d2d245a5a53a50c7b6848eea2af89d5a37baccb477ae340b5acc427161a878d665b6c55ae76110846cba8a88f88bdc2f1a1c6fdaf8b2ed227d09db819ea7e27a3250aceaa3f18c3ae6e7ea570368fd8843d03d2af2c12d6898a8c7c7682eabb8b244fc132d977bc72bca23fde3c6745f05432ec8ca41c7c931c30fa2ffaaf926040ca809eea7504bcdc8ecf41005321cc6d1d88809173428dc3695039e8cfeb5e224331f73133de8b7bd8d7801a1dafb0c0b

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1292
Entropy (8bit):	5.313322114807702
Encrypted:	false
SSDEEP:	24:fiOQPpaor4CcWP3bueu8kr9pA7QACGTkTQtJZMBTiThgUNbggXEUZYME2R:+PpVk+3butNUjC0kTQzZcsSUWeR
MD5:	2AAAE5A6ECDAC529CB9E6B9292BF6402
SHA1:	753DCD88E558C08603A9171ACA8B85B806AABCE6
SHA-256:	194016CDAB7C9AE71E91968D60E0AD344EC387992AACEE1868B94AC40ADA4E32
SHA-512:	7CDA73F212F65B7E9786B8CE87ACAF38E2EBF7E03B3A46BD2610FBC5475E1BD5FC02C9E5C2B4D85DA6F415DA58577D35D7FD7B6C24E650A6C350008492BD4DAC
Malicious:	false
Preview:	.am.q.Zg.o..-..v.Y.v.{.....G.....a....B.l1...........7b....L......G!.e.1;.QN.7......J..Wz&\|...8.n{yi.(..A.c.$..Yd...ARPkZ..mC....m.\|D=....n.\..u...c.r...!".......i...."..('.@0.H6I.G.L........)0..!^y.hB.?..WZ.........u...2...N-...:..r`.---8+8*---27178735a11efb70e6b0273f52aae19386caffe3510f48c660cd5dc8a30c7b4f3391dad568d50ef0aeb45cc106d54c9d21f959a4087af817cb18b1509c2e6ff9318da282eaa42a54830d8d97ca8bdb12d8660f1e1dfe1655a4b6d507671c5e970223a07f6f1c2ff3ed8bbe93ca23f341504ddff4c68702c09d82e6d96f23c1467b95b34421459c1ea99a00ce8fdb202f2b43cc4fbb011a545adfe1e4f62e5a1b299cd8c9e5658d5a1265c8ecdc3525a6dd5d33bf48c7b7d7f628c0684939dcd896b6611f5d2d245a5a53a50c7b6848eea2af89d5a37baccb477ae340b5acc427161a878d665b6c55ae76110846cba8a88f88bdc2f1a1c6fdaf8b2ed227d09db819ea7e27a3250aceaa3f18c3ae6e7ea570368fd8843d03d2af2c12d6898a8c7c7682eabb8b244fc132d977bc72bca23fde3c6745f05432ec8ca41c7c931c30fa2ffaaf926040ca809eea7504bcdc8ecf41005321cc6d1d88809173428dc3695039e8cfeb5e224331f73133de8b7bd

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	5.147447716611432
Encrypted:	false
SSDEEP:	24:fiJ+bYRBSWxueu8kr9pA7QACGTkTQtJZMBTiThgUNbggXEUZYME2R:SR5xutNUjC0kTQzZcsSUWeR
MD5:	96C503FCCB7B331382CBA400A01F6D5E
SHA1:	A2A81DD5CC6BC2AA6C4A799CC64AE0087BD57BA0
SHA-256:	49A5353116C8DDD6F194D452D712154FE6207D593D6A1EF683122E9391D395E1
SHA-512:	F6B95D3D5B146F82826F9C83F57AACD896690D5FA395E4883B7D7F1041FF744088A479929D5FE0F5696E763C78C4C4174C503FB434D17EE679A6356D86A90324
Malicious:	false
Preview:	.am.q.Zg.o..-..v2;.vG../...o.1..k...A........B].....U4..Mgc%..o.!.+....o,....:.E.xc.....i.s...S~...$.N...It..=._.....5 ...I...+.}....&...FP...-...>..H.Y.rG......C.]...Z.........`..c...:.-.h`...\_.---8+8---27178735a11efb70e6b0273f52aae19386caffe3510f48c660cd5dc8a30c7b4f3391dad568d50ef0aeb45cc106d54c9d21f959a4087af817cb18b1509c2e6ff9318da282eaa42a54830d8d97ca8bdb12d8660f1e1dfe1655a4b6d507671c5e970223a07f6f1c2ff3ed8bbe93ca23f341504ddff4c68702c09d82e6d96f23c1467b95b34421459c1ea99a00ce8fdb202f2b43cc4fbb011a545adfe1e4f62e5a1b299cd8c9e5658d5a1265c8ecdc3525a6dd5d33bf48c7b7d7f628c0684939dcd896b6611f5d2d245a5a53a50c7b6848eea2af89d5a37baccb477ae340b5acc427161a878d665b6c55ae76110846cba8a88f88bdc2f1a1c6fdaf8b2ed227d09db819ea7e27a3250aceaa3f18c3ae6e7ea570368fd8843d03d2af2c12d6898a8c7c7682eabb8b244fc132d977bc72bca23fde3c6745f05432ec8ca41c7c931c30fa2ffaaf926040ca809eea7504bcdc8ecf41005321cc6d1d88809173428dc3695039e8cfeb5e224331f73133de8b7bd8d7801a1dafb0c0b15a1d223dcb094f306c5d2f345a01f75

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\91cec06bb2836fa5_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	5.235760516521627
Encrypted:	false
SSDEEP:	24:fijDJv8ypueu8kr9pA7QACGTkTQtJZMBTiThgUNbggXEUZYME2R:KJv8kutNUjC0kTQzZcsSUWeR
MD5:	AF0E430030CA4174062297FC461E1E34
SHA1:	80381E474F02D4A4159132B20E28A6476BDC884A
SHA-256:	3FCA7889882B6D58F5CC2BD4DAE96A8C90307390DB429AEB31DEFB1033ACCDB3
SHA-512:	BB9564F228C8AFB8B1AF674A738BB6C0CD26C83F1CA736B0C3237AB51F620500A2C52851A804BBA3A580AABB0EB7288F0799806608ED83D9271CA44888FDDC70
Malicious:	false
Preview:	.am.q.Zg.o..-..v...P....._..H..,..q4.(I.&(.,.0...e.saJ..AV.v..s....zPE.Q.....r4)C.%.....G.u9vP.pLF..h.J.^@..0..../.....c...."$T.i......[T..m.g....m........a.?...v.....3......").r..@.'....a~..`.ZT..<!W.Q_..V.;..'..>.$LY..Q@5.^A---8+8*---27178735a11efb70e6b0273f52aae19386caffe3510f48c660cd5dc8a30c7b4f3391dad568d50ef0aeb45cc106d54c9d21f959a4087af817cb18b1509c2e6ff9318da282eaa42a54830d8d97ca8bdb12d8660f1e1dfe1655a4b6d507671c5e970223a07f6f1c2ff3ed8bbe93ca23f341504ddff4c68702c09d82e6d96f23c1467b95b34421459c1ea99a00ce8fdb202f2b43cc4fbb011a545adfe1e4f62e5a1b299cd8c9e5658d5a1265c8ecdc3525a6dd5d33bf48c7b7d7f628c0684939dcd896b6611f5d2d245a5a53a50c7b6848eea2af89d5a37baccb477ae340b5acc427161a878d665b6c55ae76110846cba8a88f88bdc2f1a1c6fdaf8b2ed227d09db819ea7e27a3250aceaa3f18c3ae6e7ea570368fd8843d03d2af2c12d6898a8c7c7682eabb8b244fc132d977bc72bca23fde3c6745f05432ec8ca41c7c931c30fa2ffaaf926040ca809eea7504bcdc8ecf41005321cc6d1d88809173428dc3695039e8cfeb5e224331f73133de8b7bd8d7801a1dafb0c0b

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\927a1596c37ebe5e_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	5.233237200147881
Encrypted:	false
SSDEEP:	24:fiqwi3k6U6Mkf+Psueu8kr9pA7QACGTkTQtJZMBTiThgUNbggXEUZYME2R:q+U63frutNUjC0kTQzZcsSUWeR
MD5:	C148F1CF893C5737E24945C12862F1C0
SHA1:	A1CF09DFBC37A1E6022D482D6E7187124C2BAE1F
SHA-256:	DFDA25379E65E87F8C5A1A3018B8BB07D9CEEC6DB9DAF46C81AD94AAD617C23A
SHA-512:	4253DD2F0F466D1AF78C722BF63882A8FAD26A80C2DAEA674735080E244EE4258B910259490F8EBB5F9F8D2F0B0A3322A1BE2977CC8F944FE75FD8E79C4D8300
Malicious:	false
Preview:	.am.q.Zg.o..-..v.6.....e.P].P.$.O../.2g..t.71.^.".M..p..;4.E..@@.f}w.B.A..d...#.E...f=..K.UV.._#..<(...G....l.``........>t..I1.;......;(..h......c.wJ..N..O.i..eD....01..~y.j..NW.........-z^....%[L.y.......;aQ..x.4..8...R.`..5^Z---8+8---27178735a11efb70e6b0273f52aae19386caffe3510f48c660cd5dc8a30c7b4f3391dad568d50ef0aeb45cc106d54c9d21f959a4087af817cb18b1509c2e6ff9318da282eaa42a54830d8d97ca8bdb12d8660f1e1dfe1655a4b6d507671c5e970223a07f6f1c2ff3ed8bbe93ca23f341504ddff4c68702c09d82e6d96f23c1467b95b34421459c1ea99a00ce8fdb202f2b43cc4fbb011a545adfe1e4f62e5a1b299cd8c9e5658d5a1265c8ecdc3525a6dd5d33bf48c7b7d7f628c0684939dcd896b6611f5d2d245a5a53a50c7b6848eea2af89d5a37baccb477ae340b5acc427161a878d665b6c55ae76110846cba8a88f88bdc2f1a1c6fdaf8b2ed227d09db819ea7e27a3250aceaa3f18c3ae6e7ea570368fd8843d03d2af2c12d6898a8c7c7682eabb8b244fc132d977bc72bca23fde3c6745f05432ec8ca41c7c931c30fa2ffaaf926040ca809eea7504bcdc8ecf41005321cc6d1d88809173428dc3695039e8cfeb5e224331f73133de8b7bd8d7801a1dafb0c0b

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1292
Entropy (8bit):	5.308886285803436
Encrypted:	false
SSDEEP:	24:fimBIrn66duUIbueu8kr9pA7QACGTkTQtJZMBTiThgUNbggXEUZYME2R:Lc6vbutNUjC0kTQzZcsSUWeR
MD5:	9C3AA3B41F81D8F77192A45D55F6CB56
SHA1:	4B5C92015AC3241C5F4F57F791BFE72AB0674356
SHA-256:	30F71669818A9FB3B6BA36D7BD7A979D95825D08133221C1E2D809748624FF16
SHA-512:	3CB22567EFB1DFCF3E4BA5C7FD270B46BC9E8D874167F550AA223FFE436E2181724651645FA714696D8660ECEB59856E7AF8242225B80C592C273596EC2D6AC2
Malicious:	false
Preview:	.am.q.Zg.o..-..v~...,:........3..A.^....Mc_.Tx....9........S..Z.Gt...5....$.lw....&..]}+.p...o.}.Y...Kv..M.....%...-...ulpz...";.......1..!...6.@.4U..M..Wk.h.!.s......W%^..7tUV..gA........(.)\|M.A........=.K.cf......m....z...+.!....r...RF]d.N..d.---8+8---27178735a11efb70e6b0273f52aae19386caffe3510f48c660cd5dc8a30c7b4f3391dad568d50ef0aeb45cc106d54c9d21f959a4087af817cb18b1509c2e6ff9318da282eaa42a54830d8d97ca8bdb12d8660f1e1dfe1655a4b6d507671c5e970223a07f6f1c2ff3ed8bbe93ca23f341504ddff4c68702c09d82e6d96f23c1467b95b34421459c1ea99a00ce8fdb202f2b43cc4fbb011a545adfe1e4f62e5a1b299cd8c9e5658d5a1265c8ecdc3525a6dd5d33bf48c7b7d7f628c0684939dcd896b6611f5d2d245a5a53a50c7b6848eea2af89d5a37baccb477ae340b5acc427161a878d665b6c55ae76110846cba8a88f88bdc2f1a1c6fdaf8b2ed227d09db819ea7e27a3250aceaa3f18c3ae6e7ea570368fd8843d03d2af2c12d6898a8c7c7682eabb8b244fc132d977bc72bca23fde3c6745f05432ec8ca41c7c931c30fa2ffaaf926040ca809eea7504bcdc8ecf41005321cc6d1d88809173428dc3695039e8cfeb5e224331f73133de8b7bd

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\946896ee27df7947_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	5.219849877030444
Encrypted:	false
SSDEEP:	24:fibD2OrGBhF1ueu8kr9pA7QACGTkTQtJZMBTiThgUNbggXEUZYME2R:HBF1utNUjC0kTQzZcsSUWeR
MD5:	A853EDEA141CD8BC30987B58B8F63D97
SHA1:	44A08E81B03E1A8E04CCDEBC54027D2E7B2DD9C2
SHA-256:	A269BFC91C1020070100E31CE91B69E1F7C17B43345D6F867A1D626C655AB83A
SHA-512:	AFAC8DDEF2CDDE1599A9D34BC3C92E50125192C5689FC41B9A186A0FCE90AEE57EFA1A1A64EC9CB8DC708E706480B33718FE2D3C98F4210CFACEDEEBDBC2ACEF
Malicious:	false
Preview:	.am.q.Zg.o..-..vTFc.M;..X...1"i...f.d......, ..(.. 1..=...v..z...._'....@&..1F....C.....$...^.sY........6..a.r.....Q.FT}.\..,.Osf..O...r.h<`.\|_=.o.z....oo....&v5b....$X..-"P.z.V...D.jT87.$.......r.2p.\..:....K0.AO&.`...7.n---8+8*---27178735a11efb70e6b0273f52aae19386caffe3510f48c660cd5dc8a30c7b4f3391dad568d50ef0aeb45cc106d54c9d21f959a4087af817cb18b1509c2e6ff9318da282eaa42a54830d8d97ca8bdb12d8660f1e1dfe1655a4b6d507671c5e970223a07f6f1c2ff3ed8bbe93ca23f341504ddff4c68702c09d82e6d96f23c1467b95b34421459c1ea99a00ce8fdb202f2b43cc4fbb011a545adfe1e4f62e5a1b299cd8c9e5658d5a1265c8ecdc3525a6dd5d33bf48c7b7d7f628c0684939dcd896b6611f5d2d245a5a53a50c7b6848eea2af89d5a37baccb477ae340b5acc427161a878d665b6c55ae76110846cba8a88f88bdc2f1a1c6fdaf8b2ed227d09db819ea7e27a3250aceaa3f18c3ae6e7ea570368fd8843d03d2af2c12d6898a8c7c7682eabb8b244fc132d977bc72bca23fde3c6745f05432ec8ca41c7c931c30fa2ffaaf926040ca809eea7504bcdc8ecf41005321cc6d1d88809173428dc3695039e8cfeb5e224331f73133de8b7bd8d7801a1dafb0c0b

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\983b7a3da8f39a46_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	5.24595111482325
Encrypted:	false
SSDEEP:	24:fi2f7ZjcQ7vYnVueu8kr9pA7QACGTkTQtJZMBTiThgUNbggXEUZYME2R:d1jr2utNUjC0kTQzZcsSUWeR
MD5:	BE4314B60B9059C366A5ECBD2089E5B9
SHA1:	59F4F02EA2EEE8351CF973B24F151FED5CDE2CA3
SHA-256:	772B40E75917FF8241319EF9BCDEFB15D55A57B00271EBF9D70F9EFEACB88E3B
SHA-512:	71E8EAE8B869915C5982937E1AA22902DAEED3276C344BEE83714502F7F30D1725BB8D6016D29155F1A4C8151B7F8819783BD925AE8380354C1FB935E5A6212A
Malicious:	false
Preview:	.am.q.Zg.o..-..v.c~..s.l.k.U....<.....f{.<..\|&A.(.>....J.......m.......\|J..>.iVB:..&.%..9..3....vs+..h.0xH.[?.....7.\U....%.... .~...........A\|.Y#.8....?.i.c.,...~h.`'.Sz!tD8.p......].6.\|.....k.$~.W.y....r..V0.RM8.;X..C......G.---8+8*---27178735a11efb70e6b0273f52aae19386caffe3510f48c660cd5dc8a30c7b4f3391dad568d50ef0aeb45cc106d54c9d21f959a4087af817cb18b1509c2e6ff9318da282eaa42a54830d8d97ca8bdb12d8660f1e1dfe1655a4b6d507671c5e970223a07f6f1c2ff3ed8bbe93ca23f341504ddff4c68702c09d82e6d96f23c1467b95b34421459c1ea99a00ce8fdb202f2b43cc4fbb011a545adfe1e4f62e5a1b299cd8c9e5658d5a1265c8ecdc3525a6dd5d33bf48c7b7d7f628c0684939dcd896b6611f5d2d245a5a53a50c7b6848eea2af89d5a37baccb477ae340b5acc427161a878d665b6c55ae76110846cba8a88f88bdc2f1a1c6fdaf8b2ed227d09db819ea7e27a3250aceaa3f18c3ae6e7ea570368fd8843d03d2af2c12d6898a8c7c7682eabb8b244fc132d977bc72bca23fde3c6745f05432ec8ca41c7c931c30fa2ffaaf926040ca809eea7504bcdc8ecf41005321cc6d1d88809173428dc3695039e8cfeb5e224331f73133de8b7bd8d7801a1dafb0c0b

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	5.129569431863524
Encrypted:	false
SSDEEP:	24:fiet0NpWZ1ueu8kr9pA7QACGTkTQtJZMBTiThgUNbggXEUZYME2R:3tspWzutNUjC0kTQzZcsSUWeR
MD5:	EC428F26FAA5C406E54EAE1E59768668
SHA1:	AB35FA35783965EC6296C8FFF367C4590E5569D3
SHA-256:	E849394C2E48C84443DC0C5E0A9AFD5F41556CADC1B849071F86246CEA73E497
SHA-512:	4A1D7EDDCE60CDBD09902FB064DA117F654B84F9EC2AFBDC0407413414D01C74AE938549599A9A74946D2512ABD0EA104D4DF6673FCD204BB8990A7138EBFC5D
Malicious:	false
Preview:	.am.q.Zg.o..-..v..[.:e>..'T...:.K....j.:..E..p...Iy..m.9$.z!."V......V..M.[..Ht6..0.....D....+..u...WAF@.....%.L.._..Oj,.o..G....H{1....=_#..K....}y......_k..aG.9.d.t.2Sw...c&g>.0......#...;H...w.---8+8---27178735a11efb70e6b0273f52aae19386caffe3510f48c660cd5dc8a30c7b4f3391dad568d50ef0aeb45cc106d54c9d21f959a4087af817cb18b1509c2e6ff9318da282eaa42a54830d8d97ca8bdb12d8660f1e1dfe1655a4b6d507671c5e970223a07f6f1c2ff3ed8bbe93ca23f341504ddff4c68702c09d82e6d96f23c1467b95b34421459c1ea99a00ce8fdb202f2b43cc4fbb011a545adfe1e4f62e5a1b299cd8c9e5658d5a1265c8ecdc3525a6dd5d33bf48c7b7d7f628c0684939dcd896b6611f5d2d245a5a53a50c7b6848eea2af89d5a37baccb477ae340b5acc427161a878d665b6c55ae76110846cba8a88f88bdc2f1a1c6fdaf8b2ed227d09db819ea7e27a3250aceaa3f18c3ae6e7ea570368fd8843d03d2af2c12d6898a8c7c7682eabb8b244fc132d977bc72bca23fde3c6745f05432ec8ca41c7c931c30fa2ffaaf926040ca809eea7504bcdc8ecf41005321cc6d1d88809173428dc3695039e8cfeb5e224331f73133de8b7bd8d7801a1dafb0c0b15a1d223dcb094f306c5d2f345a01f75

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\b6d5deb4812ac6e9_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	5.235207338698008
Encrypted:	false
SSDEEP:	24:fiWN+2hueu8kr9pA7QACGTkTQtJZMBTiThgUNbggXEUZYME2R:N+iutNUjC0kTQzZcsSUWeR
MD5:	91F6D399F4E84A9692882BBB4D29BA7F
SHA1:	8FD67835416146B2B38B11D19BBBC911B3EE7BE8
SHA-256:	217E36CF05EAAAB87564BEE2A543FE253486951EBC961C0B00767CE7A755781B
SHA-512:	E9B7A572E4F33C4A5ECB4C4F696363AD50CF3637F2DE0A3225E4FD6D63ACA3F3B30D1B7B2D54D25CF5A6DAC874513EB85F73A384844A25730D04E74ADB75296E
Malicious:	false
Preview:	.am.q.Zg.o..-..v..~.L G...=...J....^T3..h....HL.d\|..R.:.nxP...8.?@..e-%..K....jK.....]C(..2..[..9....Wi..".W.F.QT.j.@.....@.I..o.^...o..A:.+....W.....a.].....e......p\..g`...+ng.^h#f38...0..P.c..}.....[..w&..hx... .....1..---8+8*---27178735a11efb70e6b0273f52aae19386caffe3510f48c660cd5dc8a30c7b4f3391dad568d50ef0aeb45cc106d54c9d21f959a4087af817cb18b1509c2e6ff9318da282eaa42a54830d8d97ca8bdb12d8660f1e1dfe1655a4b6d507671c5e970223a07f6f1c2ff3ed8bbe93ca23f341504ddff4c68702c09d82e6d96f23c1467b95b34421459c1ea99a00ce8fdb202f2b43cc4fbb011a545adfe1e4f62e5a1b299cd8c9e5658d5a1265c8ecdc3525a6dd5d33bf48c7b7d7f628c0684939dcd896b6611f5d2d245a5a53a50c7b6848eea2af89d5a37baccb477ae340b5acc427161a878d665b6c55ae76110846cba8a88f88bdc2f1a1c6fdaf8b2ed227d09db819ea7e27a3250aceaa3f18c3ae6e7ea570368fd8843d03d2af2c12d6898a8c7c7682eabb8b244fc132d977bc72bca23fde3c6745f05432ec8ca41c7c931c30fa2ffaaf926040ca809eea7504bcdc8ecf41005321cc6d1d88809173428dc3695039e8cfeb5e224331f73133de8b7bd8d7801a1dafb0c0b

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	5.2383097610083915
Encrypted:	false
SSDEEP:	24:fi5g329ueu8kr9pA7QACGTkTQtJZMBTiThgUNbggXEUZYME2R:iv9utNUjC0kTQzZcsSUWeR
MD5:	E6F466362D10BA0A7C5C0584F5B59B6F
SHA1:	D556BCA3682497D315A362F6B6559F1A98DEDEE1
SHA-256:	EC0917B3C6A69492EF2B0D8D4CE01FEF46FFC8C5356935DCE9BC5E3842098B3C
SHA-512:	303DAD5BFE5AB9E5B79F1825EAE62E8F7D888A2F5987ADDCB3F521242A576744BB7E4DDF9D4BF152960099FEE7F76544D458E78B65E5D8E09FC1CA53B98772EE
Malicious:	false
Preview:	.am.q.Zg.o..-..v....jG...X.........:Uv^(;...cilL.%.v. .]ki..s..a.#k_.3.[`.......5zh.Z........SN...Q...k..S..s...V..h.k......;.63b..U..<\|.?s.....v..xZ.2.[....50I.........7.b.TC@...p.... ......Q.F./.BD..V......O......9y..b~...o.---8+8---27178735a11efb70e6b0273f52aae19386caffe3510f48c660cd5dc8a30c7b4f3391dad568d50ef0aeb45cc106d54c9d21f959a4087af817cb18b1509c2e6ff9318da282eaa42a54830d8d97ca8bdb12d8660f1e1dfe1655a4b6d507671c5e970223a07f6f1c2ff3ed8bbe93ca23f341504ddff4c68702c09d82e6d96f23c1467b95b34421459c1ea99a00ce8fdb202f2b43cc4fbb011a545adfe1e4f62e5a1b299cd8c9e5658d5a1265c8ecdc3525a6dd5d33bf48c7b7d7f628c0684939dcd896b6611f5d2d245a5a53a50c7b6848eea2af89d5a37baccb477ae340b5acc427161a878d665b6c55ae76110846cba8a88f88bdc2f1a1c6fdaf8b2ed227d09db819ea7e27a3250aceaa3f18c3ae6e7ea570368fd8843d03d2af2c12d6898a8c7c7682eabb8b244fc132d977bc72bca23fde3c6745f05432ec8ca41c7c931c30fa2ffaaf926040ca809eea7504bcdc8ecf41005321cc6d1d88809173428dc3695039e8cfeb5e224331f73133de8b7bd8d7801a1dafb0c0b

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bf8eae3dcaf681ca_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	5.2089757199152755
Encrypted:	false
SSDEEP:	24:fiwcGmevIx1ueu8kr9pA7QACGTkTQtJZMBTiThgUNbggXEUZYME2R:b4evIx1utNUjC0kTQzZcsSUWeR
MD5:	47BE1365C8283794E79858317D967841
SHA1:	4B24E69143C64C32C5E3F931ED8CC34D84D8436F
SHA-256:	F7400EDE51FF32E07A96E4EFDB1286E45EFD4AE1949D65D917BB06B9096693F0
SHA-512:	7B5959B01C90CFC68FEF6C0F1D09C80A0F7426C1D62A489C420E32053FB5DDE0EF8A5C63A32E4159CB40E4C265AA53A2128883FC8C3C785A61BA9C7B686623FB
Malicious:	false
Preview:	.am.q.Zg.o..-..v:.......21<b.c..(E4.....\|.az.....i..q....T5dr.f....z.!Z:\|..9......r....@...1'.+.?.'..an.../..Q....Lt.`....f.....R.........6.bb......~G.wI5.....]E....\..5..G...?..+.2..-p...>N...uITY.pk......L.nto....{...2Q,..rV---8+8*---27178735a11efb70e6b0273f52aae19386caffe3510f48c660cd5dc8a30c7b4f3391dad568d50ef0aeb45cc106d54c9d21f959a4087af817cb18b1509c2e6ff9318da282eaa42a54830d8d97ca8bdb12d8660f1e1dfe1655a4b6d507671c5e970223a07f6f1c2ff3ed8bbe93ca23f341504ddff4c68702c09d82e6d96f23c1467b95b34421459c1ea99a00ce8fdb202f2b43cc4fbb011a545adfe1e4f62e5a1b299cd8c9e5658d5a1265c8ecdc3525a6dd5d33bf48c7b7d7f628c0684939dcd896b6611f5d2d245a5a53a50c7b6848eea2af89d5a37baccb477ae340b5acc427161a878d665b6c55ae76110846cba8a88f88bdc2f1a1c6fdaf8b2ed227d09db819ea7e27a3250aceaa3f18c3ae6e7ea570368fd8843d03d2af2c12d6898a8c7c7682eabb8b244fc132d977bc72bca23fde3c6745f05432ec8ca41c7c931c30fa2ffaaf926040ca809eea7504bcdc8ecf41005321cc6d1d88809173428dc3695039e8cfeb5e224331f73133de8b7bd8d7801a1dafb0c0b

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\cf3e34002cde7e9c_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	5.223625622260493
Encrypted:	false
SSDEEP:	24:fi2OVawZwrueu8kr9pA7QACGTkTQtJZMBTiThgUNbggXEUZYME2R:dOIweutNUjC0kTQzZcsSUWeR
MD5:	4995BD49553B006E9CFF323AAA560303
SHA1:	31DF72A12FF639064530F8DF84B4C16C43C8B9C3
SHA-256:	4D3FFC7162B2B42C0DAA4233F80B2A03817F460AF44EE72DBBD5A83CC4A30C1E
SHA-512:	66773500537926213F656E4CB9DF957E2F923E3852236642F85AFE9C52F4E3375B4F5DE841AE9EDF2965CA65D2C48F12BB34C47F729F18B3193B96F4E359855F
Malicious:	false
Preview:	.am.q.Zg.o..-..v.c~..s.l.k.U.........+A.<H..RT.&Y#7...a...Y.#$.V....mP.a2?I.../.!r...;=.....=........+...ztVB...AvQ..dgo.g{.0#...6.ej..`=...?.%S.)..0L9.....B.N~.1j...C...{..uI;.md.[..U8.z"'sv..PY..k.......c...@>72.N....$.[..---8+8---27178735a11efb70e6b0273f52aae19386caffe3510f48c660cd5dc8a30c7b4f3391dad568d50ef0aeb45cc106d54c9d21f959a4087af817cb18b1509c2e6ff9318da282eaa42a54830d8d97ca8bdb12d8660f1e1dfe1655a4b6d507671c5e970223a07f6f1c2ff3ed8bbe93ca23f341504ddff4c68702c09d82e6d96f23c1467b95b34421459c1ea99a00ce8fdb202f2b43cc4fbb011a545adfe1e4f62e5a1b299cd8c9e5658d5a1265c8ecdc3525a6dd5d33bf48c7b7d7f628c0684939dcd896b6611f5d2d245a5a53a50c7b6848eea2af89d5a37baccb477ae340b5acc427161a878d665b6c55ae76110846cba8a88f88bdc2f1a1c6fdaf8b2ed227d09db819ea7e27a3250aceaa3f18c3ae6e7ea570368fd8843d03d2af2c12d6898a8c7c7682eabb8b244fc132d977bc72bca23fde3c6745f05432ec8ca41c7c931c30fa2ffaaf926040ca809eea7504bcdc8ecf41005321cc6d1d88809173428dc3695039e8cfeb5e224331f73133de8b7bd8d7801a1dafb0c0b

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d5dedf551f4d1592_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	5.2616889099752955
Encrypted:	false
SSDEEP:	24:fi5grHN3qKZz+2queu8kr9pA7QACGTkTQtJZMBTiThgUNbggXEUZYME2R:iiN3xzqutNUjC0kTQzZcsSUWeR
MD5:	D026F0FA5C71D21B1E22C2B4254713BF
SHA1:	D49DDBC75F6A0D95F28D89354867E55B3E9385A2
SHA-256:	2607372EC6A2607EEE640495C0CA3E95E12F528937DE4FF9FBD24F37A10F125C
SHA-512:	97AF103D5117F339D53F0AFCCB27709DAD634DF91C825A80B7EB846479A5618EAC60F673A80C578EB30F5338B729EA4936A7173E7D185B4144FD2F011961CF72
Malicious:	false
Preview:	.am.q.Zg.o..-..v....jG...X......B.s...,...X.#...G....1..+..PSGTj....S\|OV.5.i._.....@...T...1..MO...,.P.....9n...L.e.co...T_...Tq.b..-..i....i..q....wI..k...}.Z......W:...-..%..].p/.j.Q.\\lN...+,....S$.+<.$jx...iL..^.c. .[.......---8+8*---27178735a11efb70e6b0273f52aae19386caffe3510f48c660cd5dc8a30c7b4f3391dad568d50ef0aeb45cc106d54c9d21f959a4087af817cb18b1509c2e6ff9318da282eaa42a54830d8d97ca8bdb12d8660f1e1dfe1655a4b6d507671c5e970223a07f6f1c2ff3ed8bbe93ca23f341504ddff4c68702c09d82e6d96f23c1467b95b34421459c1ea99a00ce8fdb202f2b43cc4fbb011a545adfe1e4f62e5a1b299cd8c9e5658d5a1265c8ecdc3525a6dd5d33bf48c7b7d7f628c0684939dcd896b6611f5d2d245a5a53a50c7b6848eea2af89d5a37baccb477ae340b5acc427161a878d665b6c55ae76110846cba8a88f88bdc2f1a1c6fdaf8b2ed227d09db819ea7e27a3250aceaa3f18c3ae6e7ea570368fd8843d03d2af2c12d6898a8c7c7682eabb8b244fc132d977bc72bca23fde3c6745f05432ec8ca41c7c931c30fa2ffaaf926040ca809eea7504bcdc8ecf41005321cc6d1d88809173428dc3695039e8cfeb5e224331f73133de8b7bd8d7801a1dafb0c0b

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f0cf6dfa8a1afa3d_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	5.217228499569718
Encrypted:	false
SSDEEP:	24:fi2tmwfoueu8kr9pA7QACGTkTQtJZMBTiThgUNbggXEUZYME2R:dQlutNUjC0kTQzZcsSUWeR
MD5:	6DA92D9BA580AE3A6227537F8588E9E1
SHA1:	570586850A9AD735A9216A6F2D52582EF0BC9A56
SHA-256:	93B43283914E2091BFC26886C2E3E8A6156F962FA10BA5AE634D8F6BD3D496E3
SHA-512:	387183E60B49C6DF3DD6D0FDF2A8364A9C33816C126F6C582977145211FEE4A12D2B578EA1D1BF4AF38161FBA9921F8182164F896BB3207ABC0D8FB44C2F7176
Malicious:	false
Preview:	.am.q.Zg.o..-..v.c~..s.l.k.U.........b...p..5..Eh3.}.^.<.....H....7.F..{$...=.=......._c1^.VB3.Ou.........84._S.TEX...Q.eC.1..8......A.Y.Az-.P.K.j=.a3s.>..x.W^..B..Z....yS.Q3..%MB..5. .6Q.l%~L~........~.NZ..\|L.zl....g-.."....---8+8*---27178735a11efb70e6b0273f52aae19386caffe3510f48c660cd5dc8a30c7b4f3391dad568d50ef0aeb45cc106d54c9d21f959a4087af817cb18b1509c2e6ff9318da282eaa42a54830d8d97ca8bdb12d8660f1e1dfe1655a4b6d507671c5e970223a07f6f1c2ff3ed8bbe93ca23f341504ddff4c68702c09d82e6d96f23c1467b95b34421459c1ea99a00ce8fdb202f2b43cc4fbb011a545adfe1e4f62e5a1b299cd8c9e5658d5a1265c8ecdc3525a6dd5d33bf48c7b7d7f628c0684939dcd896b6611f5d2d245a5a53a50c7b6848eea2af89d5a37baccb477ae340b5acc427161a878d665b6c55ae76110846cba8a88f88bdc2f1a1c6fdaf8b2ed227d09db819ea7e27a3250aceaa3f18c3ae6e7ea570368fd8843d03d2af2c12d6898a8c7c7682eabb8b244fc132d977bc72bca23fde3c6745f05432ec8ca41c7c931c30fa2ffaaf926040ca809eea7504bcdc8ecf41005321cc6d1d88809173428dc3695039e8cfeb5e224331f73133de8b7bd8d7801a1dafb0c0b

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f941376b2efdd6e6_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1292
Entropy (8bit):	5.28458690349933
Encrypted:	false
SSDEEP:	24:fi8DxwG3C1zuXrueu8kr9pA7QACGTkTQtJZMBTiThgUNbggXEUZYME2R:73CoutNUjC0kTQzZcsSUWeR
MD5:	3839D7DED6BC17A5AD99F64F6BB64D41
SHA1:	1DF5BBEC675FE41ACA587928753AA5E0E9FC7AFB
SHA-256:	7B1FDA7FFED2926C11CC558A8DDBF4859B542FD96818B7CBD0ED26D7DCA1E9DF
SHA-512:	69C61FB9FB5C8708974BFDF6053ABEF8D5041E617D29E3B887A1057EC075E16200F070DD831CC0E9C848247176C541C894CECD81EB7BB2FC036AADCF31A585A8
Malicious:	false
Preview:	.am.q.Zg.o..-..v..^.. 3....PE..@.]kRi............!.du..L...2Z;..V[.......vx..We:....,...zda.[.V.ZQV.=K.d.......B....c.&..SB.M. .-=..q-..Tq..N... J..4$D..I.d..B?.tS..0ru.RS..@.~..;....#.F-.;..b.....-N.W%.....Xcui..l..R.XjTT.....V.jzQ......)---8+8*---27178735a11efb70e6b0273f52aae19386caffe3510f48c660cd5dc8a30c7b4f3391dad568d50ef0aeb45cc106d54c9d21f959a4087af817cb18b1509c2e6ff9318da282eaa42a54830d8d97ca8bdb12d8660f1e1dfe1655a4b6d507671c5e970223a07f6f1c2ff3ed8bbe93ca23f341504ddff4c68702c09d82e6d96f23c1467b95b34421459c1ea99a00ce8fdb202f2b43cc4fbb011a545adfe1e4f62e5a1b299cd8c9e5658d5a1265c8ecdc3525a6dd5d33bf48c7b7d7f628c0684939dcd896b6611f5d2d245a5a53a50c7b6848eea2af89d5a37baccb477ae340b5acc427161a878d665b6c55ae76110846cba8a88f88bdc2f1a1c6fdaf8b2ed227d09db819ea7e27a3250aceaa3f18c3ae6e7ea570368fd8843d03d2af2c12d6898a8c7c7682eabb8b244fc132d977bc72bca23fde3c6745f05432ec8ca41c7c931c30fa2ffaaf926040ca809eea7504bcdc8ecf41005321cc6d1d88809173428dc3695039e8cfeb5e224331f73133de8b7bd

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f971b7eda7fa05c3_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	5.247019754496698
Encrypted:	false
SSDEEP:	24:fiqwYjXmhzqueu8kr9pA7QACGTkTQtJZMBTiThgUNbggXEUZYME2R:qIkOutNUjC0kTQzZcsSUWeR
MD5:	98D8BB1DDD922BF16F47CA47381EC844
SHA1:	9AF361C79E978B0223F8863FAA5550255F66104E
SHA-256:	7DCA9876C5DC675F1E394886284C7D0B659AD56AB5ABD749C7FF0F2F4CDFEFEC
SHA-512:	0AB0176B529CB65B167C77BCD72494785005F09C2F2C18D418357EBDD7A177DC77D86F907A5E781F3D78C19E199C3A113838C038C9B738A9DE3359BDDEAFE739
Malicious:	false
Preview:	.am.q.Zg.o..-..v.6.....e.P].P.$..._.K.K....{.g..k.ktY}.M....DK..y.!I....r....gX-.. ...F.FJN}6....\|>.....'.iM.<...NK.. dh./:.1..(..\|#R.%.....x^...p..".w..[.~.L...Q..Q.1.9.d.E.?{..6`.Q..w kW.e....a....l}O.....s.i.....q..B.......---8+8*---27178735a11efb70e6b0273f52aae19386caffe3510f48c660cd5dc8a30c7b4f3391dad568d50ef0aeb45cc106d54c9d21f959a4087af817cb18b1509c2e6ff9318da282eaa42a54830d8d97ca8bdb12d8660f1e1dfe1655a4b6d507671c5e970223a07f6f1c2ff3ed8bbe93ca23f341504ddff4c68702c09d82e6d96f23c1467b95b34421459c1ea99a00ce8fdb202f2b43cc4fbb011a545adfe1e4f62e5a1b299cd8c9e5658d5a1265c8ecdc3525a6dd5d33bf48c7b7d7f628c0684939dcd896b6611f5d2d245a5a53a50c7b6848eea2af89d5a37baccb477ae340b5acc427161a878d665b6c55ae76110846cba8a88f88bdc2f1a1c6fdaf8b2ed227d09db819ea7e27a3250aceaa3f18c3ae6e7ea570368fd8843d03d2af2c12d6898a8c7c7682eabb8b244fc132d977bc72bca23fde3c6745f05432ec8ca41c7c931c30fa2ffaaf926040ca809eea7504bcdc8ecf41005321cc6d1d88809173428dc3695039e8cfeb5e224331f73133de8b7bd8d7801a1dafb0c0b

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fd17b2d8331c91e8_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1260
Entropy (8bit):	5.185920654414697
Encrypted:	false
SSDEEP:	24:fir6pqv62ueu8kr9pA7QACGTkTQtJZMBTiThgUNbggXEUZYME2R:Ekqi2utNUjC0kTQzZcsSUWeR
MD5:	0D295FE2EEC529E7E6809238F2F7328F
SHA1:	06C29AD60FD7AF75F7B88D340B6E1B9776A1785E
SHA-256:	3BB4C943B2179514F6DD88306FC6D55CCA0CB03857F40D2BA0DBD339F6AF7522
SHA-512:	CAB0DC8E686D3A807BEEF20A1A6D464B27AF84968461B15CF8B3318B3F8AFA6F921A49CC16D60B30BB75F63C662084F6F2811C0E3F0F95B49282539CCB0BA103
Malicious:	false
Preview:	.am.q.Zg.o..-..v........Kw_oH..>t.~:.0.....A.)...M.R....]..?cs.#.K{.Ia.S_...{8j.~ /n"J.Er."..E0.\|.`...9..Z....C@:..h9......i.....p..z..w.. .0t...x.<t..t[....s_`w.=.).G..............@..\|...&.......[.#..}A..d.x..---8+8*---27178735a11efb70e6b0273f52aae19386caffe3510f48c660cd5dc8a30c7b4f3391dad568d50ef0aeb45cc106d54c9d21f959a4087af817cb18b1509c2e6ff9318da282eaa42a54830d8d97ca8bdb12d8660f1e1dfe1655a4b6d507671c5e970223a07f6f1c2ff3ed8bbe93ca23f341504ddff4c68702c09d82e6d96f23c1467b95b34421459c1ea99a00ce8fdb202f2b43cc4fbb011a545adfe1e4f62e5a1b299cd8c9e5658d5a1265c8ecdc3525a6dd5d33bf48c7b7d7f628c0684939dcd896b6611f5d2d245a5a53a50c7b6848eea2af89d5a37baccb477ae340b5acc427161a878d665b6c55ae76110846cba8a88f88bdc2f1a1c6fdaf8b2ed227d09db819ea7e27a3250aceaa3f18c3ae6e7ea570368fd8843d03d2af2c12d6898a8c7c7682eabb8b244fc132d977bc72bca23fde3c6745f05432ec8ca41c7c931c30fa2ffaaf926040ca809eea7504bcdc8ecf41005321cc6d1d88809173428dc3695039e8cfeb5e224331f73133de8b7bd8d7801a1dafb0c0b15a1d223dcb094f3

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\febb41df4ea2b63a_0.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1292
Entropy (8bit):	5.301606410364952
Encrypted:	false
SSDEEP:	24:fi2ym4C5PBrHueu8kr9pA7QACGTkTQtJZMBTiThgUNbggXEUZYME2R:uQ5rHutNUjC0kTQzZcsSUWeR
MD5:	D708692796FD0C4C31253CEA0E615B73
SHA1:	97F7CDDF6117019BCC58476DB377ADDCBA047BD0
SHA-256:	06F08FDF1DC3FF297D1C375158A32FB489C328DD0D1F4C269668F6BD12F8C114
SHA-512:	827DCCAFA35FC4BA1C57D95A047D758EDFD4256547229C825EC4F5C487EFA9B2461216B5B16DEC0335B9C464D1A7BA8C7B853A9BBDBFF9BCF1639DF874CFDA8B
Malicious:	false
Preview:	.am.q.Zg.o..-..v&c...k/sj[+......}8(+..MmC.<.......,`..zqW:/...'{......C..Om"..^.T.....Z.3.._...7...]L.Gv.`...^..Z.].1...y......Y.c......G..uh.k......o.0..{...Y...W...x..].=.."6.w.9,.%....'.....U[...W3.`.jO..I...Wr..X.V...wOja..:?oQ.Ok1Do..x..@..).---8+8---27178735a11efb70e6b0273f52aae19386caffe3510f48c660cd5dc8a30c7b4f3391dad568d50ef0aeb45cc106d54c9d21f959a4087af817cb18b1509c2e6ff9318da282eaa42a54830d8d97ca8bdb12d8660f1e1dfe1655a4b6d507671c5e970223a07f6f1c2ff3ed8bbe93ca23f341504ddff4c68702c09d82e6d96f23c1467b95b34421459c1ea99a00ce8fdb202f2b43cc4fbb011a545adfe1e4f62e5a1b299cd8c9e5658d5a1265c8ecdc3525a6dd5d33bf48c7b7d7f628c0684939dcd896b6611f5d2d245a5a53a50c7b6848eea2af89d5a37baccb477ae340b5acc427161a878d665b6c55ae76110846cba8a88f88bdc2f1a1c6fdaf8b2ed227d09db819ea7e27a3250aceaa3f18c3ae6e7ea570368fd8843d03d2af2c12d6898a8c7c7682eabb8b244fc132d977bc72bca23fde3c6745f05432ec8ca41c7c931c30fa2ffaaf926040ca809eea7504bcdc8ecf41005321cc6d1d88809173428dc3695039e8cfeb5e224331f73133de8b7bd

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1964
Entropy (8bit):	6.633775976853084
Encrypted:	false
SSDEEP:	48:y3DbBXlMbUFnalrGIcNRxaiLsnbGrCtY0XF6:+HWUFnalr2NRxaisnbG2tYsg
MD5:	582EE398562003376887036BBA2E01AA
SHA1:	AD40CA3F6547442FA05755D622937D100458D874
SHA-256:	6D2F88209D845E286001A361064DD1C9752CF46D29410B48B8EE27456F0B9F2A
SHA-512:	1A8C98C9B5C97ACC51F427BE0867E3E20EE5B2703CABC7E8089BCC623F3398DBA160811726CDECCC97C231F987CDCF29B6733C6D92CF9F70A63F1AB014F3CBC1
Malicious:	false
Preview:	.......mYS.~.}u.i.y./....p....K.....V.y.z......mN...6..".].....d.Av.L..O<.B.....u>...O).j..Au..1..z%"..Z].l..s`8......(..e.<h..RM.S.^D......D.._=.h.~.....c^.((..C...U..b.t....#<....+z2T..5...l.......m.h:..........c'..&.......G.Q........C.e..r>....R.(.Pw..+..n.....v..v:. WCH....ac..&......e2.H%.`.r..w....T..".z<...A..#.&..<....qJ..........."..x...?.M..C..W8.8[f.c...H.].e.:..L.IG..4a..T.a\Ew._.....%.n.A....LU9.6.a...........}...%].\|........Z^Lb2MF....j..jN....\..Z....ht.......\.I...^.Q...gw......eq.P1.v..b......r...'..kD1.8Zs.X1....@..? .~.....r..[.6....p..+ ..../.bK.....].j."...5......FDV?.Q..$.\....y8..X.3i..\|....f-.ub./...u8..6E..R0.qR:`..B..gr...76.H.z......)xHP..B....kOI`yt..<C..uFC..`c...l\..7ppU:sR.e..G.Y..l..+<.a.@.#Q....+.+....../s.\0. :.@....D..)3_(.w..?..I/.Z..#2.g.F....#..9.....<<..U.....}TD]RT..H.~0....#.S...2.5....MZ.8...M...in. ...Q...O.6xI}ZG-.---8+8---601a01949cc7d9574a4189c7eed92b444b157c53f3dc950aaacc8609d5ca7

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1084
Entropy (8bit):	4.3587231649831715
Encrypted:	false
SSDEEP:	24:7N8Ij20czHRlJRjFaiLBcXRe6OKmh0qXXbCabK1xY0XLpXJ+K0:lLcNRxaiLsnbGrCtY0XF6
MD5:	7FB8C0522177C72A6E03437E53B399E8
SHA1:	B161318BA26010A924E0F8F30CEA6D2B96000486
SHA-256:	6C66EA0AF2D2735CA7F3ED4D7E01176C5CEF14920056F61403A0408B3FB2B744
SHA-512:	27B9483EBBEEF76060321D35FB37380EE61CAFA66D79B9D6D49A9B62A772296287BC062739D15CA108F5B8C2C311F52170B344FEB46F444571DABA9C13D6B139
Malicious:	false
Preview:	.......mYS.~.}u...LC9.F"o.DHeO........D..j(---8+8---601a01949cc7d9574a4189c7eed92b444b157c53f3dc950aaacc8609d5ca71c8d744421e969a8d6046f62bb8304ab877bbdcaee4f46cb964a26aa04a70ca3b4b7e1ea7a519542c75d49f7e97d7ff46456ce88913199932b2eb42111067a00b8a0289f94c15c0dde8ec13f0a30be84740b50c1fb561cfac21e466a609300fb48d850f0ab78e6d4f46261904711483a00ff457c7245bfd8fd77f3d4b6369586a11bec27b5da788b2518ad7e55806b3dede55bd6cf4b6a26c5db9c0dc62d7249e74727f2992b408845028c4bc767d270c672911f77abfe7da8123ab47beb3576410fa113f894b909f93ce2e86895e9656d92d8cc2d55eb09f1074f51b400964b48264dcd168bd1eecf4ce54aab4b4cfe991bc0b9343cc71e170554bef3ed4274379a46032e956f788658b604e12495e192d0a452e56816a95421b39153e101c6e1c000b1baafc8b336b1904b78d80f314f22edc8f5a93056baca9614444f98dff68fe0a8149bfc3ee00d852df058e822d7cf9102f7108f8af62247942fdf39e96640365da6a6c462a2d94cf661b38e967b1a2370913de007ffafaaaf15dfd19c083a230e8345b32c718870dfe1a9e0d132e3f2d15ebd4833217d13c067edc49d188b59e3c56d5ccea3e12bdc12c18bac266fc2e519fceb31

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\the-real-index.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	4.4496269468912635
Encrypted:	false
SSDEEP:	24:EZ20czHRlJRjFaiLBcXRe6OKmh0qXXbCabK1xY0XLpXJ+K0:E5cNRxaiLsnbGrCtY0XF6
MD5:	021C78D34F31097D7264D226270D9828
SHA1:	05AF52792E738C2470FE8B27D614FB4B7429897A
SHA-256:	29AE8CD8085270B0056783253EB0AF7B01776302C2ADF0EA7A6E5800D40A77AC
SHA-512:	8375C94B29794B0180B04A28D9CCBC4FA894DCEEA82AD3CE6E80AD68E131456C398BFC807A327891C98A71080F3201C969203F7B1DF31EA58E95162D5F82FFB7
Malicious:	false
Preview:	.......mYS.~.}u..p.9....T...;u:._...B.."..gs.@.(......%..%---8+8---601a01949cc7d9574a4189c7eed92b444b157c53f3dc950aaacc8609d5ca71c8d744421e969a8d6046f62bb8304ab877bbdcaee4f46cb964a26aa04a70ca3b4b7e1ea7a519542c75d49f7e97d7ff46456ce88913199932b2eb42111067a00b8a0289f94c15c0dde8ec13f0a30be84740b50c1fb561cfac21e466a609300fb48d850f0ab78e6d4f46261904711483a00ff457c7245bfd8fd77f3d4b6369586a11bec27b5da788b2518ad7e55806b3dede55bd6cf4b6a26c5db9c0dc62d7249e74727f2992b408845028c4bc767d270c672911f77abfe7da8123ab47beb3576410fa113f894b909f93ce2e86895e9656d92d8cc2d55eb09f1074f51b400964b48264dcd168bd1eecf4ce54aab4b4cfe991bc0b9343cc71e170554bef3ed4274379a46032e956f788658b604e12495e192d0a452e56816a95421b39153e101c6e1c000b1baafc8b336b1904b78d80f314f22edc8f5a93056baca9614444f98dff68fe0a8149bfc3ee00d852df058e822d7cf9102f7108f8af62247942fdf39e96640365da6a6c462a2d94cf661b38e967b1a2370913de007ffafaaaf15dfd19c083a230e8345b32c718870dfe1a9e0d132e3f2d15ebd4833217d13c067edc49d188b59e3c56d5ccea3e12bdc12c18bac

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1084
Entropy (8bit):	4.3587231649831715
Encrypted:	false
SSDEEP:	24:7N8Ij20czHRlJRjFaiLBcXRe6OKmh0qXXbCabK1xY0XLpXJ+K0:lLcNRxaiLsnbGrCtY0XF6
MD5:	7FB8C0522177C72A6E03437E53B399E8
SHA1:	B161318BA26010A924E0F8F30CEA6D2B96000486
SHA-256:	6C66EA0AF2D2735CA7F3ED4D7E01176C5CEF14920056F61403A0408B3FB2B744
SHA-512:	27B9483EBBEEF76060321D35FB37380EE61CAFA66D79B9D6D49A9B62A772296287BC062739D15CA108F5B8C2C311F52170B344FEB46F444571DABA9C13D6B139
Malicious:	false
Preview:	.......mYS.~.}u...LC9.F"o.DHeO........D..j(---8+8---601a01949cc7d9574a4189c7eed92b444b157c53f3dc950aaacc8609d5ca71c8d744421e969a8d6046f62bb8304ab877bbdcaee4f46cb964a26aa04a70ca3b4b7e1ea7a519542c75d49f7e97d7ff46456ce88913199932b2eb42111067a00b8a0289f94c15c0dde8ec13f0a30be84740b50c1fb561cfac21e466a609300fb48d850f0ab78e6d4f46261904711483a00ff457c7245bfd8fd77f3d4b6369586a11bec27b5da788b2518ad7e55806b3dede55bd6cf4b6a26c5db9c0dc62d7249e74727f2992b408845028c4bc767d270c672911f77abfe7da8123ab47beb3576410fa113f894b909f93ce2e86895e9656d92d8cc2d55eb09f1074f51b400964b48264dcd168bd1eecf4ce54aab4b4cfe991bc0b9343cc71e170554bef3ed4274379a46032e956f788658b604e12495e192d0a452e56816a95421b39153e101c6e1c000b1baafc8b336b1904b78d80f314f22edc8f5a93056baca9614444f98dff68fe0a8149bfc3ee00d852df058e822d7cf9102f7108f8af62247942fdf39e96640365da6a6c462a2d94cf661b38e967b1a2370913de007ffafaaaf15dfd19c083a230e8345b32c718870dfe1a9e0d132e3f2d15ebd4833217d13c067edc49d188b59e3c56d5ccea3e12bdc12c18bac266fc2e519fceb31

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LOG.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	5.462633288626405
Encrypted:	false
SSDEEP:	24:4qq5S406UzYkdt20czHRlJRjFaiLBcXRe6OKmh0qXXbCabK1xY0XLpXJ+K0:4qnv1cNRxaiLsnbGrCtY0XF6
MD5:	B95AA0EDEE418877E548C7B6DCA2D1E1
SHA1:	2C1AED3B8202710E64711292A1F2AA0434F79318
SHA-256:	28672C9DBCBAB333963F07D5ECE73C9C071B6BB6CCAD468192E27134B706EE05
SHA-512:	75382FC8C2C02D497F87A1B9A3EAD18FE89A3A45C28A44989A645C202F48C29C28F8D79BB25C018BC9A2788A3D4640E573829DB4B8854B2813D0660225357819
Malicious:	false
Preview:	.......mYS.~.}uHP{....h..`.F...E..2.K.390.!.......6........ ...t....=D..m.....R...[......~0gb.Mpr.b.?.....O..5.n.\.n....{.P...2D....K.`........7Z .......[z.6".@R\T.......?E.....g}.}...Y.+.>...)V.n..S.)....6.u..L_...D.<b.yd}.+....w.^j{4eS.N..........'...>...2...H..2....>y.3._..Q..T...---8+8*---601a01949cc7d9574a4189c7eed92b444b157c53f3dc950aaacc8609d5ca71c8d744421e969a8d6046f62bb8304ab877bbdcaee4f46cb964a26aa04a70ca3b4b7e1ea7a519542c75d49f7e97d7ff46456ce88913199932b2eb42111067a00b8a0289f94c15c0dde8ec13f0a30be84740b50c1fb561cfac21e466a609300fb48d850f0ab78e6d4f46261904711483a00ff457c7245bfd8fd77f3d4b6369586a11bec27b5da788b2518ad7e55806b3dede55bd6cf4b6a26c5db9c0dc62d7249e74727f2992b408845028c4bc767d270c672911f77abfe7da8123ab47beb3576410fa113f894b909f93ce2e86895e9656d92d8cc2d55eb09f1074f51b400964b48264dcd168bd1eecf4ce54aab4b4cfe991bc0b9343cc71e170554bef3ed4274379a46032e956f788658b604e12495e192d0a452e56816a95421b39153e101c6e1c000b1baafc8b336b1904b78d80f314f22edc8f5a93056

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1308
Entropy (8bit):	5.349594387378699
Encrypted:	false
SSDEEP:	24:EO+7ioUCFq20czHRlJRjFaiLBcXRe6OKmh0qXXbCabK1xY0XLpXJ+K0:EO+mFC2cNRxaiLsnbGrCtY0XF6
MD5:	3AD79539939956297AE95E427074C4B9
SHA1:	8EAA8C76179C3CC9C8365DFD029CAEFDBA1B5169
SHA-256:	0D449DCA7858831116B202C1F5A0B6AAA373E12C1DE22C792EFD93781DEEF7F2
SHA-512:	39AC5D01EB3831926AF2D75739F2A9A430978FE5CECFDD3632DFC138B0BA9356938B7DCFC9C2948AF64524B2F4581396C728120E68A183097BA706DE8B0451B1
Malicious:	false
Preview:	.......mYS.~.}u.....d....TYC.IK..ZH.c..&.Or..D.p..a..o;()..o2-....A.u#.r\|..V.C.Ix.QO.....3...!.o.e.....{...y.....m...1.....s.`.6...'..M.yq...AS..Tm.2......A.#6.."bj{..F.R.a.N...q.N..k#...}.zu$Z...Dz...4x.nQK.F.0F....3../..n<.........cf..{..c_..D^E. w....f4.s---8+8*---601a01949cc7d9574a4189c7eed92b444b157c53f3dc950aaacc8609d5ca71c8d744421e969a8d6046f62bb8304ab877bbdcaee4f46cb964a26aa04a70ca3b4b7e1ea7a519542c75d49f7e97d7ff46456ce88913199932b2eb42111067a00b8a0289f94c15c0dde8ec13f0a30be84740b50c1fb561cfac21e466a609300fb48d850f0ab78e6d4f46261904711483a00ff457c7245bfd8fd77f3d4b6369586a11bec27b5da788b2518ad7e55806b3dede55bd6cf4b6a26c5db9c0dc62d7249e74727f2992b408845028c4bc767d270c672911f77abfe7da8123ab47beb3576410fa113f894b909f93ce2e86895e9656d92d8cc2d55eb09f1074f51b400964b48264dcd168bd1eecf4ce54aab4b4cfe991bc0b9343cc71e170554bef3ed4274379a46032e956f788658b604e12495e192d0a452e56816a95421b39153e101c6e1c000b1baafc8b336b1904b78d80f314f22edc8f5a93056baca9614444f98dff68fe0a8149bfc3e

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\CURRENT.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1068
Entropy (8bit):	4.256710767924944
Encrypted:	false
SSDEEP:	24:u20czHRlJRjFaiLBcXRe6OKmh0qXXbCabK1xY0XLpXJ+K0:AcNRxaiLsnbGrCtY0XF6
MD5:	2FA1129F6A9B8D9433D5E9FF0E53F484
SHA1:	7AA02B068F36D891FE2CC8369DD96A5993F9FFF0
SHA-256:	5FB4C94C26535944C605D569DE77FB538915E2DABC5D1316D3D8919F90AA2990
SHA-512:	A6C41D28DC309374934B913DB063C50E2B489DDF27B19568E9125C9BBE0D27B0A8166FA71D1E99C3A25F7AB7BBA37AC5522F264891A6AE2829BC7E6F70C1EB65
Malicious:	false
Preview:	.......mYS.~.}u/H...~h..bE`...Z---8+8---601a01949cc7d9574a4189c7eed92b444b157c53f3dc950aaacc8609d5ca71c8d744421e969a8d6046f62bb8304ab877bbdcaee4f46cb964a26aa04a70ca3b4b7e1ea7a519542c75d49f7e97d7ff46456ce88913199932b2eb42111067a00b8a0289f94c15c0dde8ec13f0a30be84740b50c1fb561cfac21e466a609300fb48d850f0ab78e6d4f46261904711483a00ff457c7245bfd8fd77f3d4b6369586a11bec27b5da788b2518ad7e55806b3dede55bd6cf4b6a26c5db9c0dc62d7249e74727f2992b408845028c4bc767d270c672911f77abfe7da8123ab47beb3576410fa113f894b909f93ce2e86895e9656d92d8cc2d55eb09f1074f51b400964b48264dcd168bd1eecf4ce54aab4b4cfe991bc0b9343cc71e170554bef3ed4274379a46032e956f788658b604e12495e192d0a452e56816a95421b39153e101c6e1c000b1baafc8b336b1904b78d80f314f22edc8f5a93056baca9614444f98dff68fe0a8149bfc3ee00d852df058e822d7cf9102f7108f8af62247942fdf39e96640365da6a6c462a2d94cf661b38e967b1a2370913de007ffafaaaf15dfd19c083a230e8345b32c718870dfe1a9e0d132e3f2d15ebd4833217d13c067edc49d188b59e3c56d5ccea3e12bdc12c18bac266fc2e519fceb31df9fc01c919cbb2b

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1388
Entropy (8bit):	5.578590310900536
Encrypted:	false
SSDEEP:	24:4MhmSLAuDw20czHRlJRjFaiLBcXRe6OKmh0qXXbCabK1xY0XLpXJ+K0:4QAuWcNRxaiLsnbGrCtY0XF6
MD5:	07C6AE3BC96A6AC6F48E14E10F7711F4
SHA1:	EE2AC3C8EEB5B9FD6A05B945300FBBFFE8723860
SHA-256:	6451005710ABED7814FEC4AE4498C8908CB19DE13E90E9B699766EA9C7FFBA9C
SHA-512:	52E5A0200C26D7D9A3F138A82783250273839D2117509B8D418519B1332C6AAE5F93A208A31652A6857C4120CCC492B7349D05AC22120AE6AF5C113B0B3831D1
Malicious:	false
Preview:	.......mYS.~.}uHP{....h..`.F...3.......\|(J:$C.[.1..!rW.<.y..cdzo}..-.=w..'K.....c.c..>..U..L.&0.];q[cs.~..d.k.\u^.2<.$....3.qt......g....7..."V)z..E.X.....T...u...l.U2.O.....MD.^.y4..Srn.:s7.z~D..~..<c.......&.t2.V..cr......H.. .tS...c>R.{.....(.0..&.).....d..H.$hb.>P.?7..@T?..JLaJ...w.......bC.gd&. .4..=.o.L.t. ..5..\|...E[.._.\---8+8---601a01949cc7d9574a4189c7eed92b444b157c53f3dc950aaacc8609d5ca71c8d744421e969a8d6046f62bb8304ab877bbdcaee4f46cb964a26aa04a70ca3b4b7e1ea7a519542c75d49f7e97d7ff46456ce88913199932b2eb42111067a00b8a0289f94c15c0dde8ec13f0a30be84740b50c1fb561cfac21e466a609300fb48d850f0ab78e6d4f46261904711483a00ff457c7245bfd8fd77f3d4b6369586a11bec27b5da788b2518ad7e55806b3dede55bd6cf4b6a26c5db9c0dc62d7249e74727f2992b408845028c4bc767d270c672911f77abfe7da8123ab47beb3576410fa113f894b909f93ce2e86895e9656d92d8cc2d55eb09f1074f51b400964b48264dcd168bd1eecf4ce54aab4b4cfe991bc0b9343cc71e170554bef3ed4274379a46032e956f788658b604e12495e192d0a452e56816a95421b39153e101c6

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1356
Entropy (8bit):	5.494702233853671
Encrypted:	false
SSDEEP:	24:RBcKXwAMWDE9G2Q20czHRlJRjFaiLBcXRe6OKmh0qXXbCabK1xY0XLpXJ+K0:D3L26cNRxaiLsnbGrCtY0XF6
MD5:	E167284F2594BACD8BC036F82C66B086
SHA1:	6E6AD24B5BF02E0BB418559EB043D7CC8BAB7495
SHA-256:	55AC3F57CFC0B551C05975DC3F6D4A32BB9DAD731692E66FCEACCD345AD022A4
SHA-512:	10AC227E1DE14F1F488647ED00B345296FDC386DF786DFB1DE329E15438048273E5AC88ECFB907D6C215152F6C90DDA7FE024A760F1E953E2FD094D7C2EECFFD
Malicious:	false
Preview:	.......mYS.~.}u.....d....TYC.IK..m.{[..]U.2...R.:.Rw.@&......9.T?....X.....B..~../<{...r}ijaT....EW..bQ..f...}~...IY..>.....8p.7.........I...(..-a..u.- .../.V3ch.........<i..v..bL...H-+J.....f.Q..(Z;M.0.....X...Q...'...G.Y.L!.XYO...e3Z...n_}._....6..9u...._.....S..e......7D./......D...._.b.".3.%{..."..---8+8*---601a01949cc7d9574a4189c7eed92b444b157c53f3dc950aaacc8609d5ca71c8d744421e969a8d6046f62bb8304ab877bbdcaee4f46cb964a26aa04a70ca3b4b7e1ea7a519542c75d49f7e97d7ff46456ce88913199932b2eb42111067a00b8a0289f94c15c0dde8ec13f0a30be84740b50c1fb561cfac21e466a609300fb48d850f0ab78e6d4f46261904711483a00ff457c7245bfd8fd77f3d4b6369586a11bec27b5da788b2518ad7e55806b3dede55bd6cf4b6a26c5db9c0dc62d7249e74727f2992b408845028c4bc767d270c672911f77abfe7da8123ab47beb3576410fa113f894b909f93ce2e86895e9656d92d8cc2d55eb09f1074f51b400964b48264dcd168bd1eecf4ce54aab4b4cfe991bc0b9343cc71e170554bef3ed4274379a46032e956f788658b604e12495e192d0a452e56816a95421b39153e101c6e1c000b1baafc8b336b1904b78d80f31

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\MANIFEST-000001.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	4.43365278389969
Encrypted:	false
SSDEEP:	24:PtK20czHRlJRjFaiLBcXRe6OKmh0qXXbCabK1xY0XLpXJ+K0:PicNRxaiLsnbGrCtY0XF6
MD5:	D60BAEE91ECD953A1A6C33A7BC291CD2
SHA1:	D30B916248CF80257704667F6E921420433D57E8
SHA-256:	9C6163E9E5E4E3155DB60355BBA71C0E09E885068C712DA9228C36A3E519F697
SHA-512:	245B7D2ABF81A58B26970FA365E8CAF31C6954CD0CAEAE9E88F60A7B9D501803F75632C3BE653A1EC4B21ED917851CADA62109F0C28D1516294DC7D7A04A820E
Malicious:	false
Preview:	.......mYS.~.}u..6.>..q.1%....cnN....q+.....}.....3.'...;..---8+8---601a01949cc7d9574a4189c7eed92b444b157c53f3dc950aaacc8609d5ca71c8d744421e969a8d6046f62bb8304ab877bbdcaee4f46cb964a26aa04a70ca3b4b7e1ea7a519542c75d49f7e97d7ff46456ce88913199932b2eb42111067a00b8a0289f94c15c0dde8ec13f0a30be84740b50c1fb561cfac21e466a609300fb48d850f0ab78e6d4f46261904711483a00ff457c7245bfd8fd77f3d4b6369586a11bec27b5da788b2518ad7e55806b3dede55bd6cf4b6a26c5db9c0dc62d7249e74727f2992b408845028c4bc767d270c672911f77abfe7da8123ab47beb3576410fa113f894b909f93ce2e86895e9656d92d8cc2d55eb09f1074f51b400964b48264dcd168bd1eecf4ce54aab4b4cfe991bc0b9343cc71e170554bef3ed4274379a46032e956f788658b604e12495e192d0a452e56816a95421b39153e101c6e1c000b1baafc8b336b1904b78d80f314f22edc8f5a93056baca9614444f98dff68fe0a8149bfc3ee00d852df058e822d7cf9102f7108f8af62247942fdf39e96640365da6a6c462a2d94cf661b38e967b1a2370913de007ffafaaaf15dfd19c083a230e8345b32c718870dfe1a9e0d132e3f2d15ebd4833217d13c067edc49d188b59e3c56d5ccea3e12bdc12c18bac

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1548
Entropy (8bit):	5.982958592780204
Encrypted:	false
SSDEEP:	24:LtGhHDIcORboYjw5mybzJZ20czHRlJRjFaiLBcXRe6OKmh0qXXbCabK1xY0XLpXq:hSlORboY8bz/cNRxaiLsnbGrCtY0XF6
MD5:	D2A0BD2BCADC7CE8137BA338E7DCCF0E
SHA1:	D4DAB72ACBF00B90B5438CE2720ECD17D6FE5830
SHA-256:	04A6B12ACE5F227330EEBE212DACE9B36160DB068CF275E75F234E3DBB928C41
SHA-512:	F82BA07E3FE8D99CEAA5AE01C59E8E6506516BB5BE342903B71873DDB487D13B45F1B0E5979971AE5B1752EB461523480BDA3C115FF54B947704BA374C57096D
Malicious:	false
Preview:	.......mYS.~.}u.G&~.5.n9.b........_z..X.q...@. ......._h..y6....e...".h..Z...[....=./.a..I......0........%.(Wg.......j.....1p.%L..pO.<o.NF...>...o....A.s.#.dDMS...{..'.S..3`]W.ZQ.U.....n...".;...(.4...I,/...6....7W......"w.._x4&.%......1.(..XK.....:.../.X0<.s...D.6...)....Z.+...#_V#..8.W..........:Fh ..^.s.......~.&Q\.../1..fR.mX.7.2..+V~$....X...~...aD?D+c...mY7.<...&...X7Y.Y2`.x.g....b.Y......>..D2..r/@.....[..$..Gs.me............&{..2...Yo[X..2...O`4&!...t9.Re.R..G...#.....B..j}.KI---8+8---601a01949cc7d9574a4189c7eed92b444b157c53f3dc950aaacc8609d5ca71c8d744421e969a8d6046f62bb8304ab877bbdcaee4f46cb964a26aa04a70ca3b4b7e1ea7a519542c75d49f7e97d7ff46456ce88913199932b2eb42111067a00b8a0289f94c15c0dde8ec13f0a30be84740b50c1fb561cfac21e466a609300fb48d850f0ab78e6d4f46261904711483a00ff457c7245bfd8fd77f3d4b6369586a11bec27b5da788b2518ad7e55806b3dede55bd6cf4b6a26c5db9c0dc62d7249e74727f2992b408845028c4bc767d270c672911f77abfe7da8123ab47beb3576410fa113f894b909f93ce2e86895e965

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\MANIFEST-000001.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	4.43365278389969
Encrypted:	false
SSDEEP:	24:PtK20czHRlJRjFaiLBcXRe6OKmh0qXXbCabK1xY0XLpXJ+K0:PicNRxaiLsnbGrCtY0XF6
MD5:	D60BAEE91ECD953A1A6C33A7BC291CD2
SHA1:	D30B916248CF80257704667F6E921420433D57E8
SHA-256:	9C6163E9E5E4E3155DB60355BBA71C0E09E885068C712DA9228C36A3E519F697
SHA-512:	245B7D2ABF81A58B26970FA365E8CAF31C6954CD0CAEAE9E88F60A7B9D501803F75632C3BE653A1EC4B21ED917851CADA62109F0C28D1516294DC7D7A04A820E
Malicious:	false
Preview:	.......mYS.~.}u..6.>..q.1%....cnN....q+.....}.....3.'...;..---8+8---601a01949cc7d9574a4189c7eed92b444b157c53f3dc950aaacc8609d5ca71c8d744421e969a8d6046f62bb8304ab877bbdcaee4f46cb964a26aa04a70ca3b4b7e1ea7a519542c75d49f7e97d7ff46456ce88913199932b2eb42111067a00b8a0289f94c15c0dde8ec13f0a30be84740b50c1fb561cfac21e466a609300fb48d850f0ab78e6d4f46261904711483a00ff457c7245bfd8fd77f3d4b6369586a11bec27b5da788b2518ad7e55806b3dede55bd6cf4b6a26c5db9c0dc62d7249e74727f2992b408845028c4bc767d270c672911f77abfe7da8123ab47beb3576410fa113f894b909f93ce2e86895e9656d92d8cc2d55eb09f1074f51b400964b48264dcd168bd1eecf4ce54aab4b4cfe991bc0b9343cc71e170554bef3ed4274379a46032e956f788658b604e12495e192d0a452e56816a95421b39153e101c6e1c000b1baafc8b336b1904b78d80f314f22edc8f5a93056baca9614444f98dff68fe0a8149bfc3ee00d852df058e822d7cf9102f7108f8af62247942fdf39e96640365da6a6c462a2d94cf661b38e967b1a2370913de007ffafaaaf15dfd19c083a230e8345b32c718870dfe1a9e0d132e3f2d15ebd4833217d13c067edc49d188b59e3c56d5ccea3e12bdc12c18bac

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Cookies.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	21532
Entropy (8bit):	2.0913233296794127
Encrypted:	false
SSDEEP:	48:SpNdO4x3EJUVa02vVawNLopFgU10X5RpQ4lZVofWFW8NrBFcNRxaiLsnbGrCtY0Q:OZ+UVwheYRpxqOFPCNRxaisnbG2tYsg
MD5:	D0214682A5297DDB0535D24EFF402BB4
SHA1:	87C196158EFE218DCE0901CEBFDC2003F859E30E
SHA-256:	E03975A13EDE59394C3709DDE0B3B8CE7F674FF92FD429B585C040E46570F276
SHA-512:	5371B47EC1B92C5EC59CBEA47F3C630B8FFF381FD011FAC7C33731825A347165926FF36F41C2F8E39EDF9F69C0BF2B53C3F8B7F844AAF883A2CB9A112BE830F8
Malicious:	false
Preview:	.......mYS.~.}u&.6&.L.e2..^....U..f..!.......K..^G..f..["5.S_}....Q..7=\.{;.:C;.:D}Y..Um.nB@..Y..r..n..."...2....}...{.}0.tm..k....y.y[..;.I.......q+....9;..@WK..5.D.A...b.ek.{..M.Y.i....c[P......1q_.hf!k..........K./...8.q.=d...N...n.3V.H.3..........s....,G..(./..[...eA...0.[.....w.5...gH..3....E_D..N.HC21a.....X....b...dvW...B.l'...J%.4...bg.d....q....9...m...$..bf......(=y...R..<].....2(..Mn1a`.}.....U......... ....Z...2...4.>%i....8.k.&ko.s@......W.....K..g....R.<v....Z.]..OY9.......:K~.AY;....4`m}#.M4vRWoC...C...8c.HO%..e.[...-9...y..a......~z.,......j.-...B.....}...4.^;..e......\|Z...=wt.B.P.[..Av-.hIW.^.I....\|.Lx....:......W.....1.D..."..;.Yy.w.....sy#.....x....:.>........r.k....WL\..n......7(:....i(.\.L......O........^..[\....+8.n......Xu.2k.a.$...^R...u.n.......1&.'...........oP.]..B.I9.df.<......B..t.<.......V.....F..\.\.,....F....?.F_...{(...JNh....~M.tF./.x...N...u...oBV...~Y.z.D.=..2ec.....+.,9.4w..t9...#.J..,l.aq....Y

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1148
Entropy (8bit):	4.701804538320577
Encrypted:	false
SSDEEP:	24:CTGMBKSkjiAUkGK+DlaIjIEqIDgYZ3CE2hHWmz6eWJ+UoeMBxwfnyg3tVS:CqMBZkji0rk5AIE0SEFmQJfRMQny+S
MD5:	449988382BD5EFF626D682B5A6AD451C
SHA1:	A77FC4A6CB5BDE513F045D9B86183061BF469B36
SHA-256:	1D0016BB40ADDBE30E4DD0254EDADF3EBD13F070E14C75554B0B83E44B2062F1
SHA-512:	DB946A1C253C39688ADE71CDD5AA3B248DF60D20A889C808CF41CAEE58A742F968DDC53EBEBE36DDE2F1C1F1072549ACFADDAC0E98BB7E492B642C774F8A5A46
Malicious:	false
Preview:	.....k.._...........6BL...K.A.C.......s..o...t..I....Y.W..g5.`R-.M...7-......7Qz.%......XWM..ig..C..kk.._---8+8---2d48a8b423165408b50143fee184b00613a9a5dbf71420d1755eb5ea25b99555c93905bb55dcaf358915451647a792e10c5b33a3013d165934e55303571f6c817661816f3df232dd9f1d0077db736a37610c9c2ea8f94287e357093adf1b220c22b328515b787cdf130fbe638be51ef987abde281ebb2c1ddd2fa428d638a4aaaf585cc5d9b94f42121ef343539595f209852c9428c4ee7dfee09efd8bb21c6e6788c5d17c2622654e4cf3865b275ad7f2d8a7fb29a68d217beeaea949870847c4042709bae38d9076e82c05c8fa473da9093f57931406afa833d0678b5a12538c4724687c3c6393b971a5397097e95fba0642b77cbceade1e2a4ea4392bf63997d3f2eb0eb5f96c2dbc019bf715ec3bb54e14385e67040ffe106ed7a84318249403511e26876c7c1ccebffa16846346b0f44d72c0a8d7b70d328e2e262ec59d4edb8b66c86b183c95bd4e6b5a7dad08fb856f910998e2e817b3ba638f884cc8e13e7863a1106291a65c7554deb67620b1e2a4fa3d1459342024000d0636a064ed5353c9c996acc692af7a739b13efca56b169a3201149975c3ea9f48ff57810b348ec7af5b2821b4930e88ccd639f9acf1498ad4b049

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Reporting and NEL.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	37916
Entropy (8bit):	2.061400455830885
Encrypted:	false
SSDEEP:	192:TS+4DbIEumQv8m1ccnvSSDyVQlGHWUg+rHQCDQmOFIvOanyV:h4DApZQQGB38mOFd8yV
MD5:	E7F699779E5BD9046A1CFBEB992DCE40
SHA1:	F1737C77072BFE63F9245130F8431819C2CF9A8A
SHA-256:	8D5C14A7A801270317E0D2D4AB7B0F69EFDD39DF20AA9A532A6B26443867C9A1
SHA-512:	EC03414BD73A98AEF1841E6FE607D96D88085D31CE3F6DA036FDDFDC9818C4B48088405BFAA86049F074CDD00AEBADECDFC87B1C13821A4A4BE5DE0C86CA293D
Malicious:	false
Preview:	.....k.._.....2.]..#...z......w\...Wz.8.d..Z..P.r.;......k.x1....:._.rQZ.]R{x.....(B.X.^.3..<.).........l.i.6..r.m@.H..>!...\|..~-....Db..K......a.-.2iV...de&)Yc?..b./C..a..=.ngH..._/a$.~.w.Shs.]...;2c8~..z.(.o%z......o..\3....R.6.R..d..sG..Y.a.i.:zC).6....g.C.-..X."b.!...M.9...)=`(...^..........J.)sG.)iI...\{....Mi/.(d.%[Q}.Z.MF....in.S...D...x.w..A.~+.{....r...gK..j.=-.k.....D....-.(tI..f..>....uZ....9). m?sl.V.L..B...6R.EE.&9.....nSi.k..$.....jM..;..s..C.=...)...]`f..C..}..r'..)R,...h.....;..df.m.V...n^.Sf.[...;.\P...,...q\|A<GA.P4..6.8l.Xv....W.*}..9R....,h{.....B.T..zl5.&:d.sT<.)[..%.Z.Q....0.0(..9..\..d...5..u .....1J..F.&`.t.....5.M'.\H..^.-W.g...}....m.....q9h....U~Q<.d^...l...O...iI.49...l)...>....=.....#c...m..E..\|.P.......a..i.[.....V4D.ES.D).9i.J.........Z..{........[.W.z.,7.R.[.....tY8_.6.2y..../.gd...!...B.B4..>.\.7L.#}OpKF...!l..4i...9.M.D.P..."..Q.$o.H.)5?....XYq.y..2...E..M..ky...Y.{.....!.q....J#H.e...@k.Yp....\..8.`P...

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	5.478707785013672
Encrypted:	false
SSDEEP:	24:CULTQm5riDSkjiAUkGK+DlaIjIEqIDgYZ3CE2hHWmz6eWJ+UoeMBxwfnyg3tVS:CUL/r7kji0rk5AIE0SEFmQJfRMQny+S
MD5:	0C81F7B70A47DCAE4C28CD4A23811082
SHA1:	6F412FF50408E077D79DD88F185E12127B7B6E4A
SHA-256:	1CA059466C7520ECB4DBAD67D122DC3BD1C6E1B19C17D6E5AA17958DA775D799
SHA-512:	301BE7537BDFB3FB1BB04446F6CF5AFD12496E8672A08C32F4D141F5ACEF675562F9C68E723995B4328D6C51711EC23A884D03B80523A41C2CA2E9473430FC92
Malicious:	false
Preview:	.....k.._.......c.J@.?.K.xh2.:A."^.g.E..,R.J.XC..->.-tJo.s....r.E.......&.).I.../9(T.n`..9.$....-..H...t"........^.FL..........O......QZ.J.{.5E...u..0I...+.d8...6mA.....`$V\|v..w...:%......`w......q..k....< ..T...x^<P.k7...y..'..k>..TW..1/'.@.R...Qi...^..q.-D39.......j....m..~.....kU.r.4W..9.---8+8---2d48a8b423165408b50143fee184b00613a9a5dbf71420d1755eb5ea25b99555c93905bb55dcaf358915451647a792e10c5b33a3013d165934e55303571f6c817661816f3df232dd9f1d0077db736a37610c9c2ea8f94287e357093adf1b220c22b328515b787cdf130fbe638be51ef987abde281ebb2c1ddd2fa428d638a4aaaf585cc5d9b94f42121ef343539595f209852c9428c4ee7dfee09efd8bb21c6e6788c5d17c2622654e4cf3865b275ad7f2d8a7fb29a68d217beeaea949870847c4042709bae38d9076e82c05c8fa473da9093f57931406afa833d0678b5a12538c4724687c3c6393b971a5397097e95fba0642b77cbceade1e2a4ea4392bf63997d3f2eb0eb5f96c2dbc019bf715ec3bb54e14385e67040ffe106ed7a84318249403511e26876c7c1ccebffa16846346b0f44d72c0a8d7b70d328e2e262ec59d4edb8b66c86b183c95bd4e6b5a7dad08fb856f910998e

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\CURRENT.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1068
Entropy (8bit):	4.260042071408896
Encrypted:	false
SSDEEP:	24:CxjSkjiAUkGK+DlaIjIEqIDgYZ3CE2hHWmz6eWJ+UoeMBxwfnyg3tVS:CYkji0rk5AIE0SEFmQJfRMQny+S
MD5:	115018432FBB648D06A53FB5F09C766E
SHA1:	5448CF99018E8F0CC074DE0AF45E6A2A55A76938
SHA-256:	CF5AB6140B6C38C0396D01FB964A83ED417FF9B7664F6A446535432B0B0F50AA
SHA-512:	EE9AAFC0ED333520BFF47FEF356186F1808118475234768A5D7F617A4EAA4A2BB7F46E1E421B0053AD2C7F1810D2D342082FC4C0368DBF9117982DB4DF1470C6
Malicious:	false
Preview:	.....k.._.......^.......FHw3.---8+8---2d48a8b423165408b50143fee184b00613a9a5dbf71420d1755eb5ea25b99555c93905bb55dcaf358915451647a792e10c5b33a3013d165934e55303571f6c817661816f3df232dd9f1d0077db736a37610c9c2ea8f94287e357093adf1b220c22b328515b787cdf130fbe638be51ef987abde281ebb2c1ddd2fa428d638a4aaaf585cc5d9b94f42121ef343539595f209852c9428c4ee7dfee09efd8bb21c6e6788c5d17c2622654e4cf3865b275ad7f2d8a7fb29a68d217beeaea949870847c4042709bae38d9076e82c05c8fa473da9093f57931406afa833d0678b5a12538c4724687c3c6393b971a5397097e95fba0642b77cbceade1e2a4ea4392bf63997d3f2eb0eb5f96c2dbc019bf715ec3bb54e14385e67040ffe106ed7a84318249403511e26876c7c1ccebffa16846346b0f44d72c0a8d7b70d328e2e262ec59d4edb8b66c86b183c95bd4e6b5a7dad08fb856f910998e2e817b3ba638f884cc8e13e7863a1106291a65c7554deb67620b1e2a4fa3d1459342024000d0636a064ed5353c9c996acc692af7a739b13efca56b169a3201149975c3ea9f48ff57810b348ec7af5b2821b4930e88ccd639f9acf1498ad4b049f5523b2be27226b64bc2ac28f1cbb2cf43bba6b0205528a8bf36e3f7f6f262177eab1e0159a64fca

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1372
Entropy (8bit):	5.5677336950854555
Encrypted:	false
SSDEEP:	24:CBQQh+fWPIzSkjiAUkGK+DlaIjIEqIDgYZ3CE2hHWmz6eWJ+UoeMBxwfnyg3tVS:CeQh+eRkji0rk5AIE0SEFmQJfRMQny+S
MD5:	D95670972480EC05F55B1CACF6F76990
SHA1:	6F388E736180ED054EAFF725DD82634A437CC5A5
SHA-256:	2D6BF86B602FF3E8BF1EE158E6AEAA30141B9B195CCA6C0DE22F5E0B538E6680
SHA-512:	D9EBBF5BDFEE36A39C776904D50387A863DF3516BCF1B797EC9CBE0CF58B03858BDBA5783721113E3E1242EA4BBCEC2F3E50BFAA9DED2816C8291DD11331D014
Malicious:	false
Preview:	.....k.._.....ns!......Z.d..r....$3..9.p...).C.=..Y4.\>.....h.T.BV\/....s.?..WK.1'.\....>....../.$.H..\$`s..K.}...!..Q%P}....U.@......G..)...%..5.Wi..2..E....2/O^G.FT....y..r..7.$o.@2..6.>,.LFV.0.l..3N..&..Z.3s.cC.T..~..h..7g.id..o....n.!.T..T...1/....P.U>4..#.q.Tt..'v..._M./..\|Y.WV[\|Z...w.@..... "g...L.........C---8+8*---2d48a8b423165408b50143fee184b00613a9a5dbf71420d1755eb5ea25b99555c93905bb55dcaf358915451647a792e10c5b33a3013d165934e55303571f6c817661816f3df232dd9f1d0077db736a37610c9c2ea8f94287e357093adf1b220c22b328515b787cdf130fbe638be51ef987abde281ebb2c1ddd2fa428d638a4aaaf585cc5d9b94f42121ef343539595f209852c9428c4ee7dfee09efd8bb21c6e6788c5d17c2622654e4cf3865b275ad7f2d8a7fb29a68d217beeaea949870847c4042709bae38d9076e82c05c8fa473da9093f57931406afa833d0678b5a12538c4724687c3c6393b971a5397097e95fba0642b77cbceade1e2a4ea4392bf63997d3f2eb0eb5f96c2dbc019bf715ec3bb54e14385e67040ffe106ed7a84318249403511e26876c7c1ccebffa16846346b0f44d72c0a8d7b70d328e2e262ec59d4edb8b66c86b1

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	5.462659257943959
Encrypted:	false
SSDEEP:	24:CoVFwJ/UJy+SkjiAUkGK+DlaIjIEqIDgYZ3CE2hHWmz6eWJ+UoeMBxwfnyg3tVS:CocGwtkji0rk5AIE0SEFmQJfRMQny+S
MD5:	EE209EB6251D79126ADB70ED36A2701E
SHA1:	79B50D6AF1ED0877023A35BA289C301AA816D86E
SHA-256:	B776B2225A34064D9F7913659552162C24B9E35D1494CA8A5E1623FCBEA104EB
SHA-512:	D4D7A023478ED07B41C09284CAD1BFD5A913B32F850B8F5529374AD2C707BC023598F4AC3E7C8BE0F97D00673C8AB87B71F3E65F713A71F9398BA5C1BE14490F
Malicious:	false
Preview:	.....k.._.....;.J._.. Mx.^.E.]..j3...Pj{W..r.Er.HFzF ....%B..o.C.z.?qF.k..uE...9....Z.`..T...P.(.........d..V1=...!..UQ...A..[...9.....5......#4./!J6[.%{{(8e.. .r..I.p...`.;...h.. .e_..X.^........y.L....g..B..23}....i..(x...p.j.,.zk....X..d...)._....O-.+A^...a0.6}s...9...:kI......---8+8---2d48a8b423165408b50143fee184b00613a9a5dbf71420d1755eb5ea25b99555c93905bb55dcaf358915451647a792e10c5b33a3013d165934e55303571f6c817661816f3df232dd9f1d0077db736a37610c9c2ea8f94287e357093adf1b220c22b328515b787cdf130fbe638be51ef987abde281ebb2c1ddd2fa428d638a4aaaf585cc5d9b94f42121ef343539595f209852c9428c4ee7dfee09efd8bb21c6e6788c5d17c2622654e4cf3865b275ad7f2d8a7fb29a68d217beeaea949870847c4042709bae38d9076e82c05c8fa473da9093f57931406afa833d0678b5a12538c4724687c3c6393b971a5397097e95fba0642b77cbceade1e2a4ea4392bf63997d3f2eb0eb5f96c2dbc019bf715ec3bb54e14385e67040ffe106ed7a84318249403511e26876c7c1ccebffa16846346b0f44d72c0a8d7b70d328e2e262ec59d4edb8b66c86b183c95bd4e6b5a7dad08fb856f910998e

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\MANIFEST-000001.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	4.430309014702333
Encrypted:	false
SSDEEP:	24:CfC2bhjSkjiAUkGK+DlaIjIEqIDgYZ3CE2hHWmz6eWJ+UoeMBxwfnyg3tVS:CfC2bwkji0rk5AIE0SEFmQJfRMQny+S
MD5:	12677E47B8BFB66B0429319101B2F44F
SHA1:	A93133F35862B9DFA180596F73067C616B56B681
SHA-256:	BF6ED4EF6D32983792E7F887FC7066BEE0252F652E375589B0E6E9A570B492B7
SHA-512:	91816708548917C9051EA7A3DF97350A6F5B3445216C858855FA37D0CFA6BAA9E44FA62DF7AC2020770E1D10FAA2E8723C09D5642C4037BE0606782097438F70
Malicious:	false
Preview:	.....k.._.........9....r[.9...[.o...r.........zC....\.U..8a)---8+8---2d48a8b423165408b50143fee184b00613a9a5dbf71420d1755eb5ea25b99555c93905bb55dcaf358915451647a792e10c5b33a3013d165934e55303571f6c817661816f3df232dd9f1d0077db736a37610c9c2ea8f94287e357093adf1b220c22b328515b787cdf130fbe638be51ef987abde281ebb2c1ddd2fa428d638a4aaaf585cc5d9b94f42121ef343539595f209852c9428c4ee7dfee09efd8bb21c6e6788c5d17c2622654e4cf3865b275ad7f2d8a7fb29a68d217beeaea949870847c4042709bae38d9076e82c05c8fa473da9093f57931406afa833d0678b5a12538c4724687c3c6393b971a5397097e95fba0642b77cbceade1e2a4ea4392bf63997d3f2eb0eb5f96c2dbc019bf715ec3bb54e14385e67040ffe106ed7a84318249403511e26876c7c1ccebffa16846346b0f44d72c0a8d7b70d328e2e262ec59d4edb8b66c86b183c95bd4e6b5a7dad08fb856f910998e2e817b3ba638f884cc8e13e7863a1106291a65c7554deb67620b1e2a4fa3d1459342024000d0636a064ed5353c9c996acc692af7a739b13efca56b169a3201149975c3ea9f48ff57810b348ec7af5b2821b4930e88ccd639f9acf1498ad4b049f5523b2be27226b64bc2ac28f1cbb2cf43bba6b0205528a8

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	132124
Entropy (8bit):	1.3554836032095285
Encrypted:	false
SSDEEP:	384:SoGNChAEwrrykvFEcf28cjuzdDYoFl5U4GMCZ/su8yV:ANChAEwKkvF/fsjuZ0oFJLCZ/D8yV
MD5:	A96F3F3A10427F8549897AE2E8D1B316
SHA1:	B6CE2970924AD3C9D9CA82FF1DEAC5C67C949A92
SHA-256:	1E2D2922BE4051BDB7C7D2B73428ECB29D1A062E5EF1B0BD617F8F313DC88464
SHA-512:	19E307161ECD49F97FA70AB32E270F8E2DEDEF1A7B04431A19EC1A52DC4409AB7B80EC66EA2065AF17ACCFF51BDB81A67B55E33B29D4B8EFC199E759B51C93BF
Malicious:	false
Preview:	.....k.._.......^>...`{...$..P<E..).j...x\.....R..}.f...R..5......z.b./...K.-.o.i....-....]..^..&...^N+Rv2..QJ...O}j.u.....k.!Q'{.4..b.kaN.M...Y...... F....).Na........D.>.R".i..t9W^.2...;Tj..._C.0......4^.{..I..5G...ZJO./mVv.........."i.u.../.Rgf..F..........)....EF..y^.L.........b............._..BK...>.3:.....,...8z).. ..Kf.....1.1..>.g.....KcE....fR.pz...L&G.R."....S....@...$..?....e![.m._._.Z.5.C...y.~.R.3..O..x../N.e.L.......No....V^I1.u...."...Q}...^....rnh.......n.%wi....4.".E.dI..F...I.[..R..du."%.@..ww74&...D.....gy..X..!o....=H.jx}.F;)..j........r.]t...C.[.J...i`.+..7L!...1...H.d;...#.s.......7...;.`si.c.h..B.."....27.)..?.6..sP.....:...d..D+..H.\|.B.)...F.#@`.G>..e.J.w.&....Mv.b)<.......>..{$D..w...p.".........5.<....{.l....AK......Ok...k.....[o*..;..l"3Z.']PdF.<'...\.-.x.hy.;=...j....[0..V.t...G.B...v.[#...(l.b.....X...D...w.G<K.f.....)...!+A..D..u}..hw.m.B...j...../...K......KS..{.f".W..\"ydW....]...p.t=~N....C.....

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\336a045b-df12-4067-9f71-93ee2edb038d\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cookie\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Adobe\AcroCef\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	2285
Entropy (8bit):	6.797586654898117
Encrypted:	false
SSDEEP:	48:UZMBQ+k/cCY8O5Fk4vugxasr+a5f/CCJmbJVS27V:owQOC5E/vuA7rJ5faCgSyV
MD5:	D0E75FEE6600BC2A3599CCD830BB3C4E
SHA1:	4C1F33BA4F28CEC216037DEC9B45771202E274D9
SHA-256:	F4AF9DFB27EDF97F13D1B676802C8A047BA6929D57F1DC9529AFF73E66508411
SHA-512:	973F03AA429062D0D3942D0807B839B2DB664130554D750CDE89DECBC743A99F9EC57FEB956F856DA787A427D9C3068CD1AFDC1BA8E57C3CBFE741C9DF44D75B
Malicious:	false
Preview:	....S.]...;.{i.{cg.P....h...d..l...h.L.ep.2w..:..........O.!...@..C.....r..I......26...\.%BqoH..$L?....b..C.%..lo\G..J&..U#.;#b.b.tb"...n}y...U..........j'X..C..=..1;4.....`..........;.p.4[..2.M].(.J....i@\|c3.....L.z........^...u..E.hU.u..._..n..+[.J\.N..3......!..U.q.{.DN..y...M.9..yN.......o...R.p........}..e&!....B..w.....!#.\|h!..l.3n;.y.;.6n.q.F.n..=...m.B.f...%(].$53.[P.hy..\..+d.8.f.....826;_.w..y..CGC.m:..S...J`.P.."rz..W...........KF=......!..X7....(...P.2,....)6IR..X......."...HN....,...]...cws'...^C+...H.....dg...>.(.ZF2......G....._.yW....>K.\|..d.S...n...5.C:..0#..um".&k.....b.9_8I0Ez..}7....2e..89.k...P..gV.p:...`..r5?..m./..j..c..d..agsgi...8..73O.#......h..]".-....)f0.b...0..z_..+&..(O..3.^..4.P..A..^V.Mt.mq....w...@}.-..;....-.>Z.J..LrvTBI......F...)..5nm...9...3.X....m.w 5#...3O.....!].G{... ....t...3... C...e...]...6..@......^.R....L..jK...0.._.b.......I...."..NM.!.F..@....Uj.2.....D...u.U........'......x..9.]...~

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	186156
Entropy (8bit):	5.805305239223674
Encrypted:	false
SSDEEP:	1536:hD1oWFMWQNk1KUQII5J5lZRk6VtFiQibVJDS+Stu/3IVQBrp3MQjtf0CXLhNHqTp:NipIVdL3PSQ07ZmandGCyN2mM7IgO9tC
MD5:	2BE4B5EB9EC0ECA77806EFF08BEDE909
SHA1:	2EB0C72E9316DB7CD9DA4134AE4FB28517B1C949
SHA-256:	3C200843555CBD7AFC54060C88C6A681CEEDC4FB526E7C42FC798DB505FEA074
SHA-512:	7293AE46CC3522116A54D5A9C73F1C612AF39E8410C616A587A1C61B5C940E167AB064881E477026826C7BB73E1BDCC45488672748038A0F4490A2A53C75B941
Malicious:	false
Preview:	....S.]...;.{i.{cg.P....h...d..l...h.L.ep.2w..:..........{.z..zzY.......G.....h..-.F....I..i.~..m..a5K'y....Hy......NT..~.e..]%.........4.....c..k.G.=V}3.z..T.....;.g....S..Q.c6.x..S6,...D`W..U...6...E...3_..f+....x<.gk..}..G....e#i..].....,.]:" ..o4x2@...E..Xuk.RPh..?.._.)+.J+..:.X.N... qs.7.0..c{.L.(..Zr..#.P\.:./.....:>......A..b..F.S.{........b.~_.......D_..2.........u.Z7..DB\.`..W..z...f}.E^.V....p.....1.H..pa.\|.cZ..5.....T.8........,.y$...i.y...>f.%s.O......."<!~T/S.tw......Z.......G.H"..wx..H}AU.&u.8x#.S.#wH.......q..j.={....x.^...s.....w.,Z.....l4..Y......C.....<....NF\|...?{.u.\|.6.1.o)....6p...^Rl@.yn.9. .%... [.w..........K.m...)./h.R....A........^...W...5q..(`..5#x5..?'_C.d.w'[....&..f.':.........k.s^..x..KF..}T.af.8?..P.R)...Uc-?.t....U-.g.....J.'kO.l.RC.m.Z..s........6c..Oj.......K..D.C.E..l.....p02K.6.g..V.mj.Q1.k.,W...i..x.T..3\...WR.._G.....u.....;../.H.!g....Y.x........,9.o..........~R..i..D.K6;.IKhl...........

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	11932
Entropy (8bit):	6.085891884482851
Encrypted:	false
SSDEEP:	192:Ov5E/vuA36oS6oaf6okL6oD6oQ6oc6od6oc6oyls6oNtfZ6oztou6outi16o+oX8:L3H3vSvavavDvQvcvdvcvylsvNtfZvzG
MD5:	BD4BCAFBC79990E637860385D4EC4979
SHA1:	C9D3BF32E467E7C00B3063017A770BB1C542A4A1
SHA-256:	D30593F3D1403A52235FEF113E37AFF89CAB1B1A461B5BB3CB925E05E26079A6
SHA-512:	56ABAB728AD1EC207764102D474E6C63739CD8C46896765501ADD37BED085AD7BD9AAAF67FE9DF090FEE99E3323D8508B81967CDF5A710A874580B77FECDF101
Malicious:	false
Preview:	....S.]...;.{i.{cg.P....h...d..l...h.L.ep.2w..:..........O.!...@..C.....r..I......26...\.%BqoH..$L?....b..C.%..lo\G..J&..U#.;#b.b.tb"...n}y...U..........j'X..C..=..1;4.....`..........;.p.4[..2.M].(.J....i@\|c3.....L.z........^...u..E.hU.u..._..n..+[.J\.N..3......!..U.q.{.DN..y...M.9..yN.......o...R.p........}..e&!....B..w.....!#.\|h!..l.3n;.y.;.6n.q.F.n..=...m.B.f...%(].$53.[P.hy..\..+d.8.f.....826;_.w..y..CGC.m:..S...J`.P.."rz..W...........KF=......!..X7....(...P.2,....)6IR..X......."...HN....,...]...cws'...^C+...H.....dg...>.(.ZF2......G....._.yW....>K.\|..d.S...n...5.C:..0#..um".&k.....b.9_8I0Ez..}7....2e..89.k...P..gV.p:...`..r5?..m./..j..c..d..agsgi...8..73O.#......h..]".-....)f0.b...0..z_..+&..(O..3.^..4.P..A..^V.Mt.mq....w...@}.-..;....-.>Z.J..LrvTBI......F...)..5nm...9...3.X....m.w 5#...3O.....!].G{... ....t...3... C...e...]...6..@......^.R....L..jK...0.._.b.......I...."..NM.!.F..@....Uj.2.....D...u.U........'......x..9.]...~

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	228054
Entropy (8bit):	4.2000027939762905
Encrypted:	false
SSDEEP:	1536:x5hOKPN1AfiyzDsvK3XEiAD7VE2YvYwgMI5DZxpNfkgNp491C:IKPN9K2YvYwgfDZdfkgNM1C
MD5:	283AEF715A10C6AF3F438F19254D64F3
SHA1:	27E94541835C79ACD642208FAC5E720DAB41EA6A
SHA-256:	21048E029312466223D2604396181DB9AD6A9E2223D93D833083F3CBADCFA181
SHA-512:	8B3602948DA23B0DC313FCF93D17F842EE70F8CDB131BB25B65FD0CD40020DDB1C8A18F8AFADEA74165AA04D844FCF029364E1142A87237724A441AF2B1EF633
Malicious:	false
Preview:	....S.]...;.{i..Q..B.......3.8....F.5..x.x.?qH...3....r...N...m..V..p.i...&.}....D...Sp9.f...Y.p.N<N.r1B..U1.h.H.2;-/..X..$......((...P..K...j.=]......[.."..f..y...b.x.B]..R.;._u.'.G..+7x.EYf..X....d......Y.@.C.QV{.(5WL.'h.f..(....(.....B...$D......a.P...&..XN..y..$8....]j....`....5J_...7.l.y.A.ru(...../....(z.s..fxk.V.M......o.Ep.n[..u7........cT.sl..wn...e.X.~...]Y1p..LF..v0`..X......+...L.... D6w..4.~.F.q....S<j.)).Mx.B..@>~&.#._..N.=.C...;.G)..j..3..23{.n......c8..$'3[......Y_q...UR)...g.e.M\o0$.I..c.G..a...d..<..?g......,......>&yG.n..W.....;m...8..W[...B.[.{..$...../.Y.p0.#=EEB3u.. &O..I.?...#.Z.{b...n.AC..LU>........[b.yL..f.;b'.q)>....O.` .#...Y.Z...v.....,....Q2$..Q!..!.$.+...U.@.)7c.O.n....yY...Ud'_.~_vLn........B.~..../.. ..-...........z..XF."...N)N.h..b.%....\2......~.....<...R..ch{..L.-_+P.1.F...:...<.C.at?c.p..6LL.&P..v.Q...(.3W8..~...+.D.vJ'.nA.V...B.1...1.1.w.\.....1.R...y.t..2........W.N../..98Q..h.).W...[.........V.U..N`O.*.Zk.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1356
Entropy (8bit):	5.49512609186796
Encrypted:	false
SSDEEP:	24:U1VUxOSXbCx5cortH+lmF3WIf/7mCliH+m9pE+VS27tItC:UjyXmxbr+a5f/CCJmbJVS27V
MD5:	3232163C6E66C8CFB6260ACB778FD23C
SHA1:	8AF39C9BF67A93304341AD52D87352DB144F9E32
SHA-256:	5A193B6B8F7D60F512D91F7D1EB0E9B780E71BF15F5A15BB0E9F202AE10EB947
SHA-512:	492E5592D5F82628400F3D093EC77F9AE398C824AEA10E2824E4B40F01F0DFF7ED7FE984C36640043CD125A3A492C29873E23C70B352513F26C78552C776E098
Malicious:	false
Preview:	....S.]...;.{i.,./...M.G.e...o....Y..DISdMb.3.;........s..5.g.M..m\|...)g.1W.:....y^G.;j&}.....I.S.._..-..Qz.....:4.o......1.........qC..EZ.F#..B..5..:P.....2#@..U.....!N..Kvj!...?...x.x7...vB3J..>E9...KK..&B..7..H..J!....h..y..U2p!.;2...H!a!.2.P......X.I)..c..~UO._../..1.......s.zI{.T0....;..X.c..SD.l...@---8+8---654ee88cb79c15b7b20148bbcfb25a616a46ce8ff70d3d06abab72be432d808938579a5bca8ff9e8914e50a740942f3c53b25bf90198942f539fe9af86bced35f5c8f6576a0bbfae97aa930b697fca521c381a4d7ad8bf389f3692a0210865f83aca8bc17075d6ac659c69ca95b8f128d6e12ac86f3c641b7a04ee521fc7aa2126b2d7e01a6d4fe341012ef2af3ca500ec26a89c9f46a2b3b9f2a57360101aa87c46f171cc0157bb7a1066a11ffaf1ab982056e3b79ca8ccfd216c46f3afde6d444d95a52df59bbd603bb8de6fe39e8b9bbb6f999fafc0dfed6020dd5c373e93b5cb77b40e10c2f5b13a3eaf471a3bd1b524f1f22dbf36172f598415ccea47c838276ea232739414bb44e82928373a8e193a0c1e87cb9a28e258d931e81782d99eb66b55a8406b0139d3676d445fa0973db71b588ede3dcca9bdbc4fbc77f0b95ebdfe0be048055b89ea6fc7d8c40

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1356
Entropy (8bit):	5.501815980088277
Encrypted:	false
SSDEEP:	24:U1VUxOSXbCvrN1IaortH+lmF3WIf/7mCliH+m9pE+VS27tItC:UjyXmb+r+a5f/CCJmbJVS27V
MD5:	DC089CA961A2E1C1F3AF883C8E21801B
SHA1:	2100CD847043A49D1FB0B8001C19827C3029E5E6
SHA-256:	575694CC4A07D38C7C9CB924C7B284F10747324B29CD854E6DA118C4E097E929
SHA-512:	054C8C2466DE4FB9EA5380320016D3BEFE5B29E23C504F2429E0F51FB64DBC7717999EA14ED559FFEACD871AB84803E431809554C24755717ECCFC730A3A2B5C
Malicious:	false
Preview:	....S.]...;.{i.,./...M.G.e...o....Y..DISdMb.3.;........s..5.g.M..m\|...)g.1W.:....y^G.;j&}.....I.S.._..-..Qz.....:4.o......1.........qC..EZ.F#..B..5..:P.....2#@..U.....!N..Kvj!...?...x.x7...vB3J..>E9....._.6......n..QI@F.l.\|..c@O.......T~.....D..#d.l)...p#."..,..5:.l!K;.d...\|.?.1.K........8(...LJ......DF.---8+8---654ee88cb79c15b7b20148bbcfb25a616a46ce8ff70d3d06abab72be432d808938579a5bca8ff9e8914e50a740942f3c53b25bf90198942f539fe9af86bced35f5c8f6576a0bbfae97aa930b697fca521c381a4d7ad8bf389f3692a0210865f83aca8bc17075d6ac659c69ca95b8f128d6e12ac86f3c641b7a04ee521fc7aa2126b2d7e01a6d4fe341012ef2af3ca500ec26a89c9f46a2b3b9f2a57360101aa87c46f171cc0157bb7a1066a11ffaf1ab982056e3b79ca8ccfd216c46f3afde6d444d95a52df59bbd603bb8de6fe39e8b9bbb6f999fafc0dfed6020dd5c373e93b5cb77b40e10c2f5b13a3eaf471a3bd1b524f1f22dbf36172f598415ccea47c838276ea232739414bb44e82928373a8e193a0c1e87cb9a28e258d931e81782d99eb66b55a8406b0139d3676d445fa0973db71b588ede3dcca9bdbc4fbc77f0b95ebdfe0be048055b89ea6fc7d8c40

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1356
Entropy (8bit):	5.484494063324296
Encrypted:	false
SSDEEP:	24:U1VUxOSXbCvrXUZByVortH+lmF3WIf/7mCliH+m9pE+VS27tItC:UjyXmQBy2r+a5f/CCJmbJVS27V
MD5:	FBFB1D2CD653AEF227367E3F37311CE3
SHA1:	FE16D2957C59D1EB8E3FF039AD741641F3765943
SHA-256:	6CB2ECCFC5BAB20AFE6EA55EE5CA581DC6A737DEC74DC26718EA42D5B890CE96
SHA-512:	3193A9788EC105473B83AF7A07234CECB5611174A4330973344D7CCD95808238E46824A404AB5D8C44F21F99C0D3AED4776E79B58EBB3F5CAD4AAE504C7578D6
Malicious:	false
Preview:	....S.]...;.{i.,./...M.G.e...o....Y..DISdMb.3.;........s..5.g.M..m\|...)g.1W.:....y^G.;j&}.....I.S.._..-..Qz.....:4.o......1.........qC..EZ.F#..B..5..:P.....2#@..U.....!N..Kvj!...?...x.x7...vB3J..>E9....._.6......n.0?2x..+.MO...A.Z.Coj..hbe.....H.B.TZ.-..`gOzI..wC/<...H_...`..S...e^.L&].z.;.3W.I.M&.B.T&---8+8*---654ee88cb79c15b7b20148bbcfb25a616a46ce8ff70d3d06abab72be432d808938579a5bca8ff9e8914e50a740942f3c53b25bf90198942f539fe9af86bced35f5c8f6576a0bbfae97aa930b697fca521c381a4d7ad8bf389f3692a0210865f83aca8bc17075d6ac659c69ca95b8f128d6e12ac86f3c641b7a04ee521fc7aa2126b2d7e01a6d4fe341012ef2af3ca500ec26a89c9f46a2b3b9f2a57360101aa87c46f171cc0157bb7a1066a11ffaf1ab982056e3b79ca8ccfd216c46f3afde6d444d95a52df59bbd603bb8de6fe39e8b9bbb6f999fafc0dfed6020dd5c373e93b5cb77b40e10c2f5b13a3eaf471a3bd1b524f1f22dbf36172f598415ccea47c838276ea232739414bb44e82928373a8e193a0c1e87cb9a28e258d931e81782d99eb66b55a8406b0139d3676d445fa0973db71b588ede3dcca9bdbc4fbc77f0b95ebdfe0be048055b89ea6fc7d8c40

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	5.4473008663755245
Encrypted:	false
SSDEEP:	24:OTV2r8TCAE2RIsSEXtHEFYHUQXrWI1SGjZ8xK0ChbFwBY47qsZiRvQmR:AVzE2iEmuLjZ8xKThx0l7FZyoa
MD5:	DC9C0C7BBA0F11F7DAAE0133CC988EAA
SHA1:	5F66DB11A3F195F7180E75F6769B4FFB97029632
SHA-256:	DFBDC5FAFF78F4F7E8350F8FBCCB96F449F546C4C3D3BED80E262C984A1291CB
SHA-512:	54E2DC04DBC7C50A5ABF775F0780E58D2DBC99D644761D9C7271947CC41BBD1844044BF6BDE9BD8F6F5CD4DC26F4EF184B7C5193BF7C53A92F79D50863DA9C94
Malicious:	false
Preview:	....8%.Y..g[^.....2{K.2..;.. .6UY+.........!~}..3..P,..fM..q..tr....V..(.A....Rt)..\|.%..}...6.......#.^...x...;-..R.W@..!g.o.^R..(...9Q.....@g.,....-..b..1B....,...>#..p.$@.Y.SN}.q...>.&g......2./@..........o...H..Pi...q.....j.&..'.DWB#.$..q4......J..0d0,.E....0.p0...#....l........+E2.....---8+8---810c672d36378df7ba66eb129f4c6bb01836f5290007420de8d202118e07b6c7dc38fac5a59c74080ea76bd12f2ef83bc30b1a748467f88702fd324119f7955872707b9682d9f03842ec38edf9796f7ee6b8ee7b8199151f36857aff31a2d1f8c22534a46a131caa4dac87a307589a65989ca5b0cdde11217475216802114a6767bd447c0c74d8725b0cbe9cf7956d3eb192dcf4d957f7ebfde06019d99a776dd7208f98652328a9c8fd1571fb4beecb4da6c1a49939c8a1b256c663471b47c02fb42fd5c6035c5b0d332d47c60bcbb53ed25e26894152dbbace1126ff70bcbb02dd7f98e8bf0a702dacd4513bf935403642c3086ad35dc18f743a1ed35902ed5611715bb42ee7138a79b79f69241ae1c8c9051dcb282bbd641f0288e62db59ae8d1ac8003a556bc67adc5e4550a0eac872589596bacf1bafa723b5b6ab9ddbe1c3f2ef0f9193715c8aa64352e1dc2b95e12372c42ef1

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	2307
Entropy (8bit):	6.836961416071695
Encrypted:	false
SSDEEP:	48:UjyXm+9hEE1EeHQGbNAl3Z2HWr+a5f/CCJmbJVS27V:QI/XEw9QGbY3Z22rJ5faCgSyV
MD5:	EAE0BB082D5D5BC4F93E1DC932A62D3B
SHA1:	ED5588DA409AE0D2C38D89FD4E5EF5B40BE694DC
SHA-256:	398DD5603811EB1219B02EAE07069EF5358556AA52BFFD2CA5A68F669A6DD2CB
SHA-512:	ABBC49CCCBFD2613FE688BBBA709F43AF7F4437F65092B50522B0BE66FE44268BA72575E75997992B465E01008553C776D37E5FC5D7637F430AABEFD0DD5F06F
Malicious:	false
Preview:	....S.]...;.{i.,./...M.G.e...o....Y..DISdMb.3.;........s..5.g.M..m\|...)g.1W.:....y^G.;j&}.....I.S.._..-..Qz.....:4.o......1.........qC..EZ.F#..B..5..:P.....2#@..U.....!N..Kvj!...?...x.x7...vB3J..>E9....._.6......n......b+;.Bo..(...d X.s.r.E...UG......L.../#..<.S.u........5.m...P...g..79`n....R.......0.rLM_.$^f....wf9M.C...tb..}s......`....!.u.1.9..5...dK...i...l.E%....T....F...!L..t.EhnI....s..b..v.#.^....e4.L...R^$.....d.v.. a.r.Oqs..@,.=.8...u...`....v...vC; .a\....=.'o.A..pj.=.N.TA.C{v....(............y...C}T./.Q...X(.E.}.........2[.....$ .z..s..Q..C. ..Ch.}=......V..h.L...3..].[......I."v.4.+...<.G.f.=..cD!,...g4=%.........+...'.``U...h.&e+{.d.....pN.Vj(.<._..T.%.].u.....GEi........_.....z.U..[.......Ij...h..$p..!.....3.H.....).....a.G...R.#..m.Xs.>$........P....(ie.g....sr....Ks...R.x......T.;N.\|....]..[.(.s.,\}A..%...].*......#.H....Wr.....KE.......?.E.s.~.p.......^}..v..G.....p.<`EN/.vP._..p.W..{h.z.Dp....b.....8j#N..q-..l!...k.q..{.@.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	2302
Entropy (8bit):	6.831488882320571
Encrypted:	false
SSDEEP:	48:AVpZaflxkbZuZ0clbYO62HHmuLjZ8xKThx0l7FZyoa:apGZ1lp62nR6xEEyT
MD5:	91F0BC9E7F0B9233EBE06DF799645F33
SHA1:	4347860149538B36D70E4EBE91BCB55F072428BA
SHA-256:	56D630B86C3E5C8BEE3761099684B89114868F2A6CE4AB18EB31D55972663C5A
SHA-512:	FCC3C3AA7420367DCD9220938177C6BD04FB4CE5BFAF4F159A3B216666ABCD6845519E8DCA4FA8F799EE4E85937822E85CDE20409301EF913B6798EEE04E46DF
Malicious:	false
Preview:	....8%.Y..g[^.....2{K.2..;.. .6UY+.........!~}..3..P,..fM..q..tr....V..(.A....Rt)..\|.%..}...6.......#.^...x...;-..R.W@..!g.o.^R..(...9Q.....@g.,....-..b..1B....,...>#..p.$@.Y.SN}.q...>.&g......2./@..........o...H...iD...Y......=..v..0.YRK.`J.l...1.$..<w..:.g.D.....5..^.^.....S.V...........g..f....W..b....&...lOi....!Q-..T...b.+w=M.l.....HM.5s.u... .F.S..@~x......:..P-@/..o;.i.............~u.y..lv.....l...A...%..0..5s ..........~.F..j.{..O.!`......6....^.?.u..~=..=.....q7.);..PW....}..._....uL.w..mtr.u...;..$RU....C..iQ........l;}..ER..n.6.FdL.@...*.^.../.Jtm..........[..7.....m..P.0...."...:.&.......^u .. ......l/.>.#..hJt.zw..{....?-.f .:z...tG...)...........3...8....C.......b..5......g..:%9......:Z.....\2...../.].7B....l.B..@lPJ....e(.P.>.....>..N7.Ug.....\a}y.......J......d.M...-.f_.+z...@>..I".,.d..~5iO.s......k1q2.9..&H.e.=..O....^........A.;..5...y...e.....}4\....G..z.....IMf...a....]F4]Oi.....v..t...o..xe..9.Zix.....^......Ra

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1356
Entropy (8bit):	5.518293637771391
Encrypted:	false
SSDEEP:	24:OTV2r8Tly/WOXtHEFYHUQXrWI1SGjZ8xK0ChbFwBY47qsZiRvQmR:AVrsW8muLjZ8xKThx0l7FZyoa
MD5:	DFBA0A142EBEF735629FA217C6BDB7FA
SHA1:	9D9487DF20F6D82F013599ED231CC3DEB1BF8D06
SHA-256:	7C0E39057EA5559845E5A8B160399FB617DD647F83514FC29CE82F41A10B3389
SHA-512:	7E60998537A60E2FBAD13675BF2E575C79DCF5B9A2073B6125FB71282729E224896F8F4A34AF51D3CB107E8856313E5CDC5EA63503AD450F50A7F34A85E6BB7C
Malicious:	false
Preview:	....8%.Y..g[^.....2{K.2..;.. .6UY+.........!~}..3..P,..fM..q..tr....V..(.A....Rt)..\|.%..}...6.......#.^...x...;-..R.W@..!g.o.^R..(...9Q.....@g.,....-..b..1B....,...>#..p.$@.Y.SN}.q...>.&g......2./@..........o...H...iD...Y......=...K.....o.Q..s...i..{8...p..c..(..E....f..T......m.?..~..6\.WD...o...7---8+8---810c672d36378df7ba66eb129f4c6bb01836f5290007420de8d202118e07b6c7dc38fac5a59c74080ea76bd12f2ef83bc30b1a748467f88702fd324119f7955872707b9682d9f03842ec38edf9796f7ee6b8ee7b8199151f36857aff31a2d1f8c22534a46a131caa4dac87a307589a65989ca5b0cdde11217475216802114a6767bd447c0c74d8725b0cbe9cf7956d3eb192dcf4d957f7ebfde06019d99a776dd7208f98652328a9c8fd1571fb4beecb4da6c1a49939c8a1b256c663471b47c02fb42fd5c6035c5b0d332d47c60bcbb53ed25e26894152dbbace1126ff70bcbb02dd7f98e8bf0a702dacd4513bf935403642c3086ad35dc18f743a1ed35902ed5611715bb42ee7138a79b79f69241ae1c8c9051dcb282bbd641f0288e62db59ae8d1ac8003a556bc67adc5e4550a0eac872589596bacf1bafa723b5b6ab9ddbe1c3f2ef0f9193715c8aa64352e1dc

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	2282
Entropy (8bit):	6.821401919574313
Encrypted:	false
SSDEEP:	48:AVmSuCtKtdcLrdtJjhOHHmuLjZ8xKThx0l7FZyoa:amPddi9jEnR6xEEyT
MD5:	F22FC944FE21E84C236B236FF418CB5A
SHA1:	DC58A2293BF6EBE6AE9921C2713550E009E63F0D
SHA-256:	5268AF4A5329F1359FE94A868BDB6DC9D3FDD9E416DE2BB2B1745E649398FF25
SHA-512:	C07AC4A34F6B9D82EE9E2B42E5178AFA9454D5DB657035C38DDBA09FFA362CD318E1144A927C5103AFF4815F99C42E2C997E8285DCBA9DA698C26127525C0622
Malicious:	false
Preview:	....8%.Y..g[^.....2{K.2..;.. .6UY+.........!~}..3..P,..fM..q..tr....V..(.A....Rt)..\|.%..}...6.......#.^...x...;-..R.W@..!g.o.^R..(...9Q.....@g.,....-..b..1B....,...>#..p.$@.Y.SN}.q...>.&g......2./@..........o...HJ.Q+..g..R.J...........=...}.......{.-.E......:..;X..#.p.........<f.\|....$.!....&.H.d...j.M.....~.zJ1.$..}^T3......W..pi..LO......."e}.o#.mC...6(\...ny.9..Y...M.={wA'.{Yl.o......G.b@.p..Q....ntU......A.z..W...B.....#.!=...Q6......d......pe.h..X.9..t..lD.@....!.DM.7...~./...BM..v..~P`6..f.....R....h.n....v M....R...p......8.t{..Y.._.0K`K..%.....Y....h....7.Q.Pk.".8.O.g..o.Yp....j.3...KL.i.,..4.$.d.\|"....s...#...R...y..(..QH.+R'.N\./A...P...WQ..<.u..ws...W....)?../..bd...!.'......l.....y...%......d.4.ZD...a2._.....'....0.Ng\....f@.8".J..n...H...D.>.\|O.IE.).S..;.wh..-.d.....-..h....G"...if.....*...G...b...XD....%..TI..q.z\...../.6..=u0V...g...O..;\|......M &...M....?...v..)0.F&..d!.u....A.G...j..h.Y...d\#.^...Uu...N...n?+..]....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1356
Entropy (8bit):	5.507840499830862
Encrypted:	false
SSDEEP:	24:OTV2r8TSPvMqXtHEFYHUQXrWI1SGjZ8xK0ChbFwBY47qsZiRvQmR:AVmVmuLjZ8xKThx0l7FZyoa
MD5:	ED5B8DFFEAA542ADB635C36D03376B55
SHA1:	97DE4D2BF05E4C6BA7C6C318609DE968465611D8
SHA-256:	9760DCC42BC5BB879377EF1277AFA7EE5EDFA78B48DF7BA6871CC6FCB0DA19B0
SHA-512:	0313BA579E9AE25EBC2B12C7CC4CD7965C9A4C510048C4208B23D10B7B8BA8A3C0CA66D63C3F243CB36CCA4A20B534D0ADA93E93692DCB4AFE73896A19761FEB
Malicious:	false
Preview:	....8%.Y..g[^.....2{K.2..;.. .6UY+.........!~}..3..P,..fM..q..tr....V..(.A....Rt)..\|.%..}...6.......#.^...x...;-..R.W@..!g.o.^R..(...9Q.....@g.,....-..b..1B....,...>#..p.$@.Y.SN}.q...>.&g......2./@..........o...H..;......\|.).X>......t......kh.7I2.....'y.Mr.....2........1h.Lb....I.t..#~M.../..G....0....{---8+8*---810c672d36378df7ba66eb129f4c6bb01836f5290007420de8d202118e07b6c7dc38fac5a59c74080ea76bd12f2ef83bc30b1a748467f88702fd324119f7955872707b9682d9f03842ec38edf9796f7ee6b8ee7b8199151f36857aff31a2d1f8c22534a46a131caa4dac87a307589a65989ca5b0cdde11217475216802114a6767bd447c0c74d8725b0cbe9cf7956d3eb192dcf4d957f7ebfde06019d99a776dd7208f98652328a9c8fd1571fb4beecb4da6c1a49939c8a1b256c663471b47c02fb42fd5c6035c5b0d332d47c60bcbb53ed25e26894152dbbace1126ff70bcbb02dd7f98e8bf0a702dacd4513bf935403642c3086ad35dc18f743a1ed35902ed5611715bb42ee7138a79b79f69241ae1c8c9051dcb282bbd641f0288e62db59ae8d1ac8003a556bc67adc5e4550a0eac872589596bacf1bafa723b5b6ab9ddbe1c3f2ef0f9193715c8aa64352e1dc

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1356
Entropy (8bit):	5.531218443540266
Encrypted:	false
SSDEEP:	24:OTV2r8T/uCGfXtHEFYHUQXrWI1SGjZ8xK0ChbFwBY47qsZiRvQmR:AVYmuLjZ8xKThx0l7FZyoa
MD5:	1C57581E399D0E9B182FF22F8F1E7FF3
SHA1:	A009FB648ECABEC5E6C026158A321405579554B0
SHA-256:	D684EA7D8F74EBBFB73D04B1D1497F35D4A6E29D8E49583E6E5C03BD7D9684A6
SHA-512:	805D92F10DA3A9996B740475CF32EC1A71FA76FA672B595136FB719497B20C3114B460C401C10F7EE0DFDF3F8E6A3E10834ED36BFDBC7CBB8BC198C5A81114D6
Malicious:	false
Preview:	....8%.Y..g[^.....2{K.2..;.. .6UY+.........!~}..3..P,..fM..q..tr....V..(.A....Rt)..\|.%..}...6.......#.^...x...;-..R.W@..!g.o.^R..(...9Q.....@g.,....-..b..1B....,...>#..p.$@.Y.SN}.q...>.&g......2./@..........o...H.l.7..a..:..v._.5.}u.D... .}I..........?..D.z.........6=...I2(...$F...W...m..U..I..<10p..---8+8---810c672d36378df7ba66eb129f4c6bb01836f5290007420de8d202118e07b6c7dc38fac5a59c74080ea76bd12f2ef83bc30b1a748467f88702fd324119f7955872707b9682d9f03842ec38edf9796f7ee6b8ee7b8199151f36857aff31a2d1f8c22534a46a131caa4dac87a307589a65989ca5b0cdde11217475216802114a6767bd447c0c74d8725b0cbe9cf7956d3eb192dcf4d957f7ebfde06019d99a776dd7208f98652328a9c8fd1571fb4beecb4da6c1a49939c8a1b256c663471b47c02fb42fd5c6035c5b0d332d47c60bcbb53ed25e26894152dbbace1126ff70bcbb02dd7f98e8bf0a702dacd4513bf935403642c3086ad35dc18f743a1ed35902ed5611715bb42ee7138a79b79f69241ae1c8c9051dcb282bbd641f0288e62db59ae8d1ac8003a556bc67adc5e4550a0eac872589596bacf1bafa723b5b6ab9ddbe1c3f2ef0f9193715c8aa64352e1dc

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	2447
Entropy (8bit):	6.854702675914598
Encrypted:	false
SSDEEP:	48:AVua+J44rSKUtNzbVk/WcHrQ9FJimuLjZ8xKThx0l7FZyoa:aV+3SKU/zSFQ9SR6xEEyT
MD5:	59CD3AB340785F47654BA4E05738C08E
SHA1:	D24CEDA9D8099AC49F7FBEF591320BB721C1CE6D
SHA-256:	77E66E88D174E2947BAC0A6B4DFD1F0C90F56B482727C06179C05862FCF29444
SHA-512:	58BC25902E517449289A2C6AC733016F25D4873F91F6507755B75EC6B20344813D0F7A3D8123C30403277DDB23A9368FD02AA64956AA95A7FD333BFA0BF4497F
Malicious:	false
Preview:	....8%.Y..g[^.....2{K.2..;.. .6UY+.........!~}..3..P,..fM..q..tr....V..(.A....Rt)..\|.%..}...6.......#.^...x...;-..R.W@..!g.o.^R..(...9Q.....@g.,....-..b..1B....,...>#..p.$@.Y.SN}.q...>.&g......2./@..........o...HP~!.m;.P...!It3......,."o.=.I....M`..1r.<......}..s;\|..gP.0.T...<%..3......6[;u.kQ...!}r.....?v..b...-.....o..&s..0<.B{ A;.X.+K....\~;B.f-....O......N....T....w.^.7).`.2k%3......a..#C...7.X...U&.U..........7..6.2zN:....>onb.t..m.5.V..N..(v.y....-..d.....X<..X=..g.{-....8.....>`..U...0[U..a.:f!...[4......e79.iFC...m.X.GK......s..GI.+..dF..9..U...AQm.%z'~nw..(..E..T..$...Gw..bX?. .J.&.<..^...)s...1....j!;0.....>.K......?.W.....4..t........T...B...I:.3..&+..Y].K...6..s2.?.!h;...9....H.N..n;..@...[.w..&g<{...z.x...W.~0k.&.)....Q.QC...w.%..z.....ust..w.'.!-.......W2[<.k.[..e..1..A&.t.Wxg..I.n.H.N.h.P.....W.L..<..D..p.9.U...o...../YM...&..a..<=.6F..6...M.s..C...gX$E.\.%1....X..s...,...W2.....zD0<.Hb...*..P.pP2SgK.N.....u6.h.0.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1356
Entropy (8bit):	5.535509390589013
Encrypted:	false
SSDEEP:	24:OTV2r8TQuSc+XtHEFYHUQXrWI1SGjZ8xK0ChbFwBY47qsZiRvQmR:AVbSmuLjZ8xKThx0l7FZyoa
MD5:	9DE7C00500D7374213A26D7A6DA68965
SHA1:	CEFE15AFAC31BC300E4FD286508A54085366AD7B
SHA-256:	757161F005411C55C0FE2D1462E55026D291C267F2DD087A3E181CCD000DC1EE
SHA-512:	34B811FFDFBF7E17F1E614CC3262B949A31C49F88C2F9A4198F5BC6CABC469A104DC5FD79785465B2CBD371997EF391A5327D67EBC57C215917A1D714B3160C6
Malicious:	false
Preview:	....8%.Y..g[^.....2{K.2..;.. .6UY+.........!~}..3..P,..fM..q..tr....V..(.A....Rt)..\|.%..}...6.......#.^...x...;-..R.W@..!g.o.^R..(...9Q.....@g.,....-..b..1B....,...>#..p.$@.Y.SN}.q...>.&g......2./@..........o...H..tz........+k..)t......".\|...m..H.'.&..).N.....0.3.....k....X.......Rp...F.%.vL....f\---8+8*---810c672d36378df7ba66eb129f4c6bb01836f5290007420de8d202118e07b6c7dc38fac5a59c74080ea76bd12f2ef83bc30b1a748467f88702fd324119f7955872707b9682d9f03842ec38edf9796f7ee6b8ee7b8199151f36857aff31a2d1f8c22534a46a131caa4dac87a307589a65989ca5b0cdde11217475216802114a6767bd447c0c74d8725b0cbe9cf7956d3eb192dcf4d957f7ebfde06019d99a776dd7208f98652328a9c8fd1571fb4beecb4da6c1a49939c8a1b256c663471b47c02fb42fd5c6035c5b0d332d47c60bcbb53ed25e26894152dbbace1126ff70bcbb02dd7f98e8bf0a702dacd4513bf935403642c3086ad35dc18f743a1ed35902ed5611715bb42ee7138a79b79f69241ae1c8c9051dcb282bbd641f0288e62db59ae8d1ac8003a556bc67adc5e4550a0eac872589596bacf1bafa723b5b6ab9ddbe1c3f2ef0f9193715c8aa64352e1dc

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	5.463100990854885
Encrypted:	false
SSDEEP:	24:OTV2r8TRDG1nd3XtHEFYHUQXrWI1SGjZ8xK0ChbFwBY47qsZiRvQmR:AVzMNmuLjZ8xKThx0l7FZyoa
MD5:	213E470796A46181D3E275CEB8D97A6A
SHA1:	8F41BEBCD5E73FEC3EF4661B482C5DB6B9EEE777
SHA-256:	DCF6E9B5F3CEFD51247749C531283033FDF005CE7A968798FE2741DCC7C68C5D
SHA-512:	4994851543F46768A90424D6383EF31CC4DECA41E5B6D41BD50CA104D09195EA212A46DB9521046738FD1BA808E82C8BF72B93E2A7B244F70F9EFA8A214FB72F
Malicious:	false
Preview:	....8%.Y..g[^.....2{K.2..;.. .6UY+.........!~}..3..P,..fM..q..tr....V..(.A....Rt)..\|.%..}...6.......#.^...x...;-..R.W@..!g.o.^R..(...9Q.....@g.,....-..b..1B....,...>#..p.$@.Y.SN}.q...>.&g......2./@..........o...H........`Bf...u...tO.v3.nk.LJ\|....-.n.!?b.9.V.oS(r.kyC.A....u...k..7.4E.....b---8+8---810c672d36378df7ba66eb129f4c6bb01836f5290007420de8d202118e07b6c7dc38fac5a59c74080ea76bd12f2ef83bc30b1a748467f88702fd324119f7955872707b9682d9f03842ec38edf9796f7ee6b8ee7b8199151f36857aff31a2d1f8c22534a46a131caa4dac87a307589a65989ca5b0cdde11217475216802114a6767bd447c0c74d8725b0cbe9cf7956d3eb192dcf4d957f7ebfde06019d99a776dd7208f98652328a9c8fd1571fb4beecb4da6c1a49939c8a1b256c663471b47c02fb42fd5c6035c5b0d332d47c60bcbb53ed25e26894152dbbace1126ff70bcbb02dd7f98e8bf0a702dacd4513bf935403642c3086ad35dc18f743a1ed35902ed5611715bb42ee7138a79b79f69241ae1c8c9051dcb282bbd641f0288e62db59ae8d1ac8003a556bc67adc5e4550a0eac872589596bacf1bafa723b5b6ab9ddbe1c3f2ef0f9193715c8aa64352e1dc2b95e12372c42ef1

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	2302
Entropy (8bit):	6.804127633648443
Encrypted:	false
SSDEEP:	48:AV2PnU+StyzXpQjSFzVLlKTXCGs9FJ9HHmuLjZ8xKThx0l7FZyoa:a2PnUbybpQjS9VZKTSl9NnR6xEEyT
MD5:	44E0951B2EA0CDB27C8311C4887276BA
SHA1:	FA3E2F4050729E96C1199A0BE7D8C87575E691ED
SHA-256:	74230B1EDD4CE81D511549FD8355D23654A32014536E44FCCFDE54CFEC64C9AA
SHA-512:	23E3A1A06F4D3D9E1BAE3030A4ADBF4B441AEA4D4F24D9856B42483BB26B828D82E2AEDF5C575C1B0238870BE22EF74BD783A32EAE5452184D20DFF4E9C2339E
Malicious:	false
Preview:	....8%.Y..g[^.....2{K.2..;.. .6UY+.........!~}..3..P,..fM..q..tr....V..(.A....Rt)..\|.%..}...6.......#.^...x...;-..R.W@..!g.o.^R..(...9Q.....@g.,....-..b..1B....,...>#..p.$@.Y.SN}.q...>.&g......2./@..........o...H...e...5..8..41.c..?`..c.l.2QYG....+.\E....p.."F.b...R.<.....]t....Z.F.....l.....S..oj..3....v.d<"...tp...J...`J..f..1...2.EiT..0...'..v..'..0.F.\|....K.D.:Z.-.."..6m...'.Ks.U..+i.M.....Z...%.. .-.!....Y....b...K.8'$......6l-4.z..&.v.k.XG..B.Qf.oh.n~+.].B..r$X....,tD..R6yG.9..)B..3f6..es....G....{..e8...7..8.9.U...0......O.JI...I....".d3"..0.._.a....(...U..<.N1.".....M.I.vB%%OG...X.K".u.k.J2.Af..#.PD..&.S$.\|=..?Rk.....O..7.q..-w.,it.E.........W6.;^w.X.$..o7.....#....?....<.2..(..>....#.{e.......xNC...phA.9.o....I...#..S.T..f.[..o....a.P=.M..! .}...k.....]......y.-...XZ.m.kM3...5.Vgr.....bt..........u2.[....e....ao......{+<}.L-D....VB+.<....:2.......r..MorR.....c.M..:'}.!}.2U...Uq....?.{....Z3..u^...)m..;8i...hk.S.S...+%..j&bX...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	6272
Entropy (8bit):	6.499497282218675
Encrypted:	false
SSDEEP:	96:aripx/+lrgWwk8Cs4w3wKh/S5ag1wAtagGmgvwaRQFJFD8zw5R6xEEyT:1P2lrgq8Cs4YVSZhgv2bB8CRzX
MD5:	21DF9CF662A7955FCEC1B6E3EF8F4421
SHA1:	DF55DEE2B4CF770DA82818911C1CB6E32BE02C0C
SHA-256:	8C43F4A7A0207F99AAA8355098D761ECC9F7C3306DC28C3B06347DEE5F38F953
SHA-512:	033FEC840C67269B0985A20BB2E4F5AB957EB5D00BA69141034FE8272764627F9411EED7C4A4C68BD204614F31FCC72125004698C2F0B3E789619F106850DE50
Malicious:	false
Preview:	....8%.Y..g[^.....2{K.2..;.. .6UY+.........!~}..3..P,..fM..q..tr....V..(.A....Rt)..\|.%..}...6.......#.^...x...;-..R.W@..!g.o.^R..(...9Q.....@g.,....-..b..1B....,...>#..p.$@.Y.SN}.q...>.&g......2./@..........o...Hb5V..~..F...@...g..=....#Y.QB.sE..7N..l.H..1...,.5.+./..N.l.\|^.g.i.2...3-...+.R.k..9#F..e..{.....Cm]..c...%_....3...._..n.. Z'......D....wu.....x.z8.&..J~.......@+......z...M.0..Im.n..+..y].........yoT.2.=...7w.(.F..u....s....... .0.~.W.:B.i[.5g.....D.jo..1..Z..I.!.....o../1>2..Bm................pX.V{wM..[....a0p...o...}..i.]..c@=.......6.M..}ue.{..K.L....>=}..2.....n...-H.9...%..["[V..2. ...N.....%.._/'a}K2.(...i;...._.z.h.....p.C....4)...Y.w....v.Q.Q..n...}~.!:....@.6..<.D.m.i.u.......`..,._+..5gUg....+#.u....R..e.....y.S.T2....A....q.Bv..8?..:.5.:...x...M!.U.H+}....Z.d.#. ..X:X......I...........T..e.F....q...#.j6NG..kA.\|lf@.C....Y.;8.".R...>.T..:.8..".,...%.X.yE.I....d.....K....v....gfp..n?&q..A.Q....my...;G...{A...o....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1836
Entropy (8bit):	6.5207466014233715
Encrypted:	false
SSDEEP:	24:OTV2r8Tnm4NwV39IUqeKVNsvgxUSPXtHEFYHUQXrWI1SGjZ8xK0ChbFwBY47qsZG:AVJeV39qSqXmuLjZ8xKThx0l7FZyoa
MD5:	24E3E357FAAACE271A2A1A9BB26BEDCC
SHA1:	79FCF5F9C35DF342030A099EDFD0623F52A547E4
SHA-256:	08E7C950AB293FE30AAF86D84DFD09C6D9C2E65CBA114ADAA3D45FFBCAEB8D95
SHA-512:	570F84D97B9B44AB283CA963618401ED166D43EE00370E4E9F34F07C8CF67CD3B1423AF75340DDE3B7DA74329091AFBD6FE45F9618E08E380651FA47B0B3890F
Malicious:	false
Preview:	....8%.Y..g[^.....2{K.2..;.. .6UY+.........!~}..3..P,..fM..q..tr....V..(.A....Rt)..\|.%..}...6.......#.^...x...;-..R.W@..!g.o.^R..(...9Q.....@g.,....-..b..1B....,...>#..p.$@.Y.SN}.q...>.&g......2./@....ns..(.@Yo.....Yax..8....J6..eg....M....%.....0......4....;......r..# o..0.[.,s..l&...".....\|..i.Zp~=.+n.Z.............!.....p...%.u@..K.F8...... .....?.\......CN9[Y..]/..EY.O=\|.&.."..P=i.....6q....D..q..........(..J....J.]...$.AA..>..0.;)....%.o..".R[....h.V;!n.......xj.t7m....;.&.o...4....e.....R#..2U..GY../n...H...-..'..Z......v....Uz.n.w...w..+B......\|.4M.I.{F..... .?(VU\<uZ.3.%...xX.b\|......G..53.j.VJ.{..5..^t.A.\|_...K.x.l..Y....c.........t.T6.B....\..@....0...YCj.......9.....r...i.f.A.=..O..?.`h.....@Q.g..._F....m#.mq.r...-.\|.I9@.......\|.....=.v)---8+8*---810c672d36378df7ba66eb129f4c6bb01836f5290007420de8d202118e07b6c7dc38fac5a59c74080ea76bd12f2ef83bc30b1a748467f88702fd324119f7955872707b9682d9f03842ec38edf9796f7ee6b8ee7b8199151f36857aff31a2d

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1068
Entropy (8bit):	4.259114707470911
Encrypted:	false
SSDEEP:	24:6K3XtHEFYHUQXrWI1SGjZ8xK0ChbFwBY47qsZiRvQmR:vmuLjZ8xKThx0l7FZyoa
MD5:	2DCC4BF03104A801B91E1A9D1D1C2B0C
SHA1:	68C21D9439C4568187D50F4F3E96B9729174D90E
SHA-256:	6DEFF236ADE39706ACAD6ADAFC0D445C59BD9D3595C140E3E75835B18F41B1E0
SHA-512:	E6E817A3490221C812E0E37CC1D578B1F9C28D1FD96BCBC6EF59EA6970B67F829061A7C456F4BCB1F3BCEC2AFE6AD8B6D6C55D1BBD4DD36F1D27E451F09DEBF2
Malicious:	false
Preview:	....8%.Y..g[^....RG..~.+..H...---8+8*---810c672d36378df7ba66eb129f4c6bb01836f5290007420de8d202118e07b6c7dc38fac5a59c74080ea76bd12f2ef83bc30b1a748467f88702fd324119f7955872707b9682d9f03842ec38edf9796f7ee6b8ee7b8199151f36857aff31a2d1f8c22534a46a131caa4dac87a307589a65989ca5b0cdde11217475216802114a6767bd447c0c74d8725b0cbe9cf7956d3eb192dcf4d957f7ebfde06019d99a776dd7208f98652328a9c8fd1571fb4beecb4da6c1a49939c8a1b256c663471b47c02fb42fd5c6035c5b0d332d47c60bcbb53ed25e26894152dbbace1126ff70bcbb02dd7f98e8bf0a702dacd4513bf935403642c3086ad35dc18f743a1ed35902ed5611715bb42ee7138a79b79f69241ae1c8c9051dcb282bbd641f0288e62db59ae8d1ac8003a556bc67adc5e4550a0eac872589596bacf1bafa723b5b6ab9ddbe1c3f2ef0f9193715c8aa64352e1dc2b95e12372c42ef10b1ceb7433ac2dfba762675c6ff7cb80a9ac40f7ff8b8aa66d7fbe37c2f743f7795998eb68fc4194a60899f690bfa66d22c6f4c88a04b656714110d5bd178efba59b240525c81d631a5ac2aee8f24bf57894be321802e232e01b33105a4afe417a21bf21edeb4d4616ae3ae4f836fa971bb68fb2933ce55d621f17858a9403a85aadcd096537ef29

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	3870
Entropy (8bit):	6.395235887611461
Encrypted:	false
SSDEEP:	48:ima5Sk8rfanh8/GZT6ZWXZYEtoitbRCwu20wD+JliWxaSFmuLjZ8xKThx0l7FZyT:iRPmah8/GZTBXppt9zlCFxhR6xEEyT
MD5:	BC6080687A8E02622E0FF74A63EB91BA
SHA1:	63B608DF23D3365AD80A1C5DD46B3A783922CFE8
SHA-256:	039B91C53148D75A79947585798433A4E42EEFDC90EAEE53DA0A99BD895C1335
SHA-512:	919ABD33E5DA5F9E48BB70AFFA02E54D37B5EB7927C7DDCB3B5619B2AE02A70433A77B154075DC66DF96AB044042A0467D0B58DBA17589251ADA01909B72E27A
Malicious:	false
Preview:	....8%.Y..g[^...~.x?LKt..W.R..>..kv.K....7..\A..&\|r.(>7.............mdb..}..Z_6.6O.^..+..76.`.wY.".6<....z.(#....K..(2..Af.....~.9%.....A.e.R.O.\.:..XG)...f....?.)..H..e)>....a).Vk<.....v42..{s1.7....O.#V...~eZ.3A.@..\|........h.j.."....#.Tf..{.7qz.]/J..x.c....l...$.z......%-.(.u....=.%...87..X.G...$..u....H........B..DS..n.P....`.b.F...v.Z...>!.2f..-...M7...,-..A~.n.,....j.D-........m.v..La.....:.....{8.e.Lt f*.(.....<m..H....An$.v..7_.o.\|.....H....=?....r..t..K..........w..x.}j....!.......L...V....X.....$....;x..i....\|0...3..Z...hB.o\....\|....B=;.?.....0..U...."j...1.sk._...X..B.P.v.V....=...Q.90~N...&..2......5Xw..d ...:.pa........a...1+.n=.....`K..".........j....J.9.3.......t...'..>.8.-.+._7.8...cM...eP.Bu..../.m...f.r..........\|[.i._{.I.jN..C.HD..L..........b[..Sj....L.&[.....P.....8. zr.........X...`.@.=u........&a.'.....<.o..]..7e. .ZT.%.I.f.?...Am.P[,.e..1..._:.uv.._._\|..b........k.#.%.'..{...y.7(..Q.AD....@.g.N.s.t.f.u."{.2....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	3.1609518576603928
Encrypted:	false
SSDEEP:	96:nhQFWDoEJfIVmsvOV+sl91S3Zydhk5/vrJ5faCgSyV:nhQFmJf9X+/k8BbHWV
MD5:	FD008683418D73683C73BD15A052B452
SHA1:	316E15CB674C986A9A381E3FF7619E652CBFD7FC
SHA-256:	592521D467746B8BC09410593BBB20B16B3CF692D61A14D54F20CEF31C0E5430
SHA-512:	2679D93A23B5C89CF0D9D15A40374150E3FB6C19672DE5643152A6E8C3D047C8040676944FB02F45AB884D2ECFB2A2D38BE05F309B084298B058DCDEF8B46907
Malicious:	false
Preview:	....S.]...;.{i..O....L..^....Y../f..n........4.\..).i.....2...z.T.....3+=..T..q.%C..WC$.G.}..V....3.........,...9.HN......U.....X8...C...pd......"z.E"...E..Z.?...d[.]%c"F;......0QU......X..'....YM....\...j.h.g...,0.../..@.:.4a2.u.]....R..kF.U:.m...5....g}......).\|.Q......7=.,.5....w..D..f......H....S.a......lT.U....7H............%U;~..0........F.....hY0..pp.{.fn.....7G...'^........p?....eco.3....R...0.?...`6O..[7".....=!i.}2A....h.,....)....l.C..xX1&D.D..l'y...i.M.i.(....c.p\|.@Y.<iu...J..(C..F.$s['...j.......].......{....Q.9....."..$.e1......F?....4.qp..r.F.R.Ff..Sm.....F#+5..^..g....n..T...I.D..-<;....Q..B ...2..}U=g.6"(78.......fa....;..-jol...........g....I.Xpw.T.u.&.f.Z.M[]..=.8..#..X....8i.. .....w.8.C$.p..}...L.E...?c..h..>........}.z...2....r.O.\.....;x..>I_.%-..2.....i...B...7.".....F.k5..y.2..rt...M...^..j..T&dh.#...o..DwBav>.f9....../.Q3R..1..G..w.Ms....D..~.\|:dP..Q..8..#8..f2/.0ir0.1.5.6Y..Ha@....4.l.).]P...%...sz.m.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	DIY-Thermocam raw data (Lepton 2.x), scale 17454-12858, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000488, slope 60420025178353737768630222848.000000
Category:	dropped
Size (bytes):	67778
Entropy (8bit):	5.9533741600673356
Encrypted:	false
SSDEEP:	768:vROpvHlrU6TeAwBzH44ADKOmJDyWb7d0Zg4pMB6YR9lXxKXxZ428qwJBQzYyo9:vqHa6TXwB44ADmDyWyJiB6KlXxUDE9
MD5:	3AF4B19122BD9B01BCEB3CEF76C39890
SHA1:	015C43284BD2017F43E0A9B957C520176634782D
SHA-256:	3F42742ECAF79B8E6D4EBA21FBA51AF625C15A30752FD060C1EC7B0A76AAC673
SHA-512:	998B01020258128BA5EEBD3597EA9FDD5C57DBFAF1AD66AA3E9C33C9B0A420F836414BA0CDC7B261F18C5CBA78700DA0D83512138C4557C130307FC9CD2E79C0
Malicious:	false
Preview:	....8%.Y..g[^...b`..X....h.d.!XR-`..k.......... ...F..X../..[....%..$!.Aie.;..\|.A+.yl..,.h.'t.7f.'9.g.......N.4E.w$.I...n..X.8...).D.=.0..?..C.Z^4m.T37.P...S(.Q.?.rp7.....z.{z.5.\".k.=.,K.x1.Fb3.%#...".........U...%..yZ..q.rD.K..:}.......c.XB..N......@....A$Z....M..lr...o]...J.7..I..+{......c....e.d.$N%$......z.l?J.6...;L.v....4.V5..k...C..Y..;S..c......h..ZR-8.%.@j!i ..............N....A(&Z..h.~...<....Y..U......x..2.e...q..W...X.)%.0....f=.(..wX..6......%R.?2.........c...T[.\|/:x...\....n\|.&...%.J?:...8.....b...".V...;...T.<.Zl.).%..z_.e.:G...^...\|&....C...../Y..W....7.D)..Xb B.(..g...h.[... J.;h..?.p..%....[4P.U.V.e.]...8.<!R.S ..a....O]. .X/....PhY.z.n.Nr...~..[.<....cv<.... .......R\...i.....}(E.J.A..L./\|<F\.......Z..J...5.{....V...~0.X..a.c.0..~..3i,...T.......Q..3:3@.U.L..V..=#.9.;QI.;p._......Rb>....A.X:.(T.j$...VF@..g...].d.H.7........i........d{..v...;.X"C...v...Wp.".;.YI..}..Zf..%d.I.. ....m&.f...V.....4..&..rjx

C:\Users\user\AppData\Local\Adobe\Acrobat\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Adobe\Color\ACECache11.lst.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1660
Entropy (8bit):	6.228887857444784
Encrypted:	false
SSDEEP:	48:CnW/xXt7Hekji0rk5AIE0SEFmQJfRMQny+S:XF9eOm/E0/nnny+S
MD5:	31C646A975AFA9761E3B1D732E705B1C
SHA1:	7C3FF4474BFB2F6D1A69629AA88CA9D34AC53F96
SHA-256:	93A8BA2ED7E08F848F06809CBB14736BD1F837888ABC1A802F6B979A1DCFA208
SHA-512:	87C06CF6F824BE89CDEAE995F2A1A50C32F99C24E77DD3B3B39E8A06DAB2E6834B1BFFDB25C560B76472416786B6195BBA7DC22266007F0BF964EB379BCD3D5A
Malicious:	false
Preview:	.....k.._.......2.(.~.. ..3x.'.ha..i7.........z].9+.u?t':....Pb.b..z.8..y" ..JS..g...).5....I.,...&Etm._1.[.....6O...sh......$jV.......g.t8..7p.i.R.....U>.."...l..l..^.e.6.....K..CvO.h...7...')......"te.n........d..RM.....-..2.~.].~.H$.;....6.......N....s..._ .....K..E,7....L..KV2KM.)&..........{..]'..<....:ZT.2.Z...v3..-.V.._....$x..".X...,m.T.ePc..?...J..>....=.^.B[.....".KC.......^.O...\|@^./....D..O{......Gl..6._U.X,..bN.....0.Q.+......l..x}..}'.z}n.(.......>........X...,....S....~...ZK.0..0.{m)...5.Ms.....;.-.f.vl..o...g.J(./..a..X...}.-B.}..!x....I..?O0...&..6.&............9J---8+8---2d48a8b423165408b50143fee184b00613a9a5dbf71420d1755eb5ea25b99555c93905bb55dcaf358915451647a792e10c5b33a3013d165934e55303571f6c817661816f3df232dd9f1d0077db736a37610c9c2ea8f94287e357093adf1b220c22b328515b787cdf130fbe638be51ef987abde281ebb2c1ddd2fa428d638a4aaaf585cc5d9b94f42121ef343539595f209852c9428c4ee7dfee09efd8bb21c6e6788c5d17c2622654e4cf3865b275ad7f2d8a7fb29a68

C:\Users\user\AppData\Local\Adobe\Color\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Adobe\Color\Profiles\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Adobe\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\CEF\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\CEF\User Data\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Comms\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Comms\UnistoreDB\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00001.jrs.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	3146779
Entropy (8bit):	1.2701547791200571
Encrypted:	false
SSDEEP:	12288:XsWXrH9kAdMPeRNlWOC800FH1xJGG8z7z+vmp:XsQz9BdMmnlHNFH9GGS7zGmp
MD5:	5435FCF2070613DFF0CE352073E19B00
SHA1:	C501F4C0A2B5B1F03E7C6753E4DEA4F7D0B2FC21
SHA-256:	D1B659C085D8750D1706589F360F2C70D3563F61C740D69F2FECAEE45D8BE65B
SHA-512:	698608D6EE5AD0975F8D23F0B35BD74022E160370BFE72D67C6B9F550FBD145F3BFB919753C02092AD970E52CA37C598662417A0079D1E710523B78FCB74CC92
Malicious:	false
Preview:	.x....?_M..Ub... ....Y.1.wQ[pV....4.......D.....@..Mcn.Dd0M.......E.g.d...........jf...5...V...I..e.mE.^..!.K...8.5d..@...<c-..9.K...f..D......t...]....].ac.......&.H.7...e.n(R:.}..;k..dT>B..S...r....g.......3..........?=.].....`.-...=KL.+....Z?.../9$.......&..w..i..4.b..-.d..]NI.Q....L.....s.m.T<.....Yo_.?,6.%.U...&..._.[G.:.d.\|IY.U .=.cP...EQ.3.y....4..6.....AP.l...R`..r.R.....`%.{.c..[U....1..2...#7...6..]...b.D......h.9.........Nu.q...}.....^p.B....9....4.]..\Q.^,....'h4..P...:n.0.H..o1..L...y....zKh#Hy.R27P.K}..."kqk.p{[.b.CR......25..`'.AXo.A...._.......g.....Ux}.l%.o.K..;.O..Y...U...C....m...-....s...bgnZ.....][x........T..R.V..H.."DHb..#.).fL.......xo..o.W...z.=P_...i..vU.2pX#..P...... ..3h....V-..\.'....B..+...M}S1.Q.L.6...&....pFP../..va......v.....$[4.....<...^..{.....E`..]Zj.}.......\.....w$,/,...Mp.V.j%.b......$...F.... .=.j.....`.Z.H)..T....&'.%....OG....\|L"#...>.4ns....f...........rQW^I..AIH%...W...k..q.E..N..]L...h}/.@..

C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00002.jrs.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	3146779
Entropy (8bit):	1.2701547791200571
Encrypted:	false
SSDEEP:	12288:XsWXrH9kAdMPeRNlWOC800FH1xJGG8z7z+vmp:XsQz9BdMmnlHNFH9GGS7zGmp
MD5:	5435FCF2070613DFF0CE352073E19B00
SHA1:	C501F4C0A2B5B1F03E7C6753E4DEA4F7D0B2FC21
SHA-256:	D1B659C085D8750D1706589F360F2C70D3563F61C740D69F2FECAEE45D8BE65B
SHA-512:	698608D6EE5AD0975F8D23F0B35BD74022E160370BFE72D67C6B9F550FBD145F3BFB919753C02092AD970E52CA37C598662417A0079D1E710523B78FCB74CC92
Malicious:	false
Preview:	.x....?_M..Ub... ....Y.1.wQ[pV....4.......D.....@..Mcn.Dd0M.......E.g.d...........jf...5...V...I..e.mE.^..!.K...8.5d..@...<c-..9.K...f..D......t...]....].ac.......&.H.7...e.n(R:.}..;k..dT>B..S...r....g.......3..........?=.].....`.-...=KL.+....Z?.../9$.......&..w..i..4.b..-.d..]NI.Q....L.....s.m.T<.....Yo_.?,6.%.U...&..._.[G.:.d.\|IY.U .=.cP...EQ.3.y....4..6.....AP.l...R`..r.R.....`%.{.c..[U....1..2...#7...6..]...b.D......h.9.........Nu.q...}.....^p.B....9....4.]..\Q.^,....'h4..P...:n.0.H..o1..L...y....zKh#Hy.R27P.K}..."kqk.p{[.b.CR......25..`'.AXo.A...._.......g.....Ux}.l%.o.K..;.O..Y...U...C....m...-....s...bgnZ.....][x........T..R.V..H.."DHb..#.).fL.......xo..o.W...z.=P_...i..vU.2pX#..P...... ..3h....V-..\.'....B..+...M}S1.Q.L.6...&....pFP../..va......v.....$[4.....<...^..{.....E`..]Zj.}.......\.....w$,/,...Mp.V.j%.b......$...F.... .=.j.....`.Z.H)..T....&'.%....OG....\|L"#...>.4ns....f...........rQW^I..AIH%...W...k..q.E..N..]L...h}/.@..

C:\Users\user\AppData\Local\Comms\UnistoreDB\USStmp.jtx.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	3146779
Entropy (8bit):	1.2701547791200571
Encrypted:	false
SSDEEP:	12288:XsWXrH9kAdMPeRNlWOC800FH1xJGG8z7z+vmp:XsQz9BdMmnlHNFH9GGS7zGmp
MD5:	5435FCF2070613DFF0CE352073E19B00
SHA1:	C501F4C0A2B5B1F03E7C6753E4DEA4F7D0B2FC21
SHA-256:	D1B659C085D8750D1706589F360F2C70D3563F61C740D69F2FECAEE45D8BE65B
SHA-512:	698608D6EE5AD0975F8D23F0B35BD74022E160370BFE72D67C6B9F550FBD145F3BFB919753C02092AD970E52CA37C598662417A0079D1E710523B78FCB74CC92
Malicious:	false
Preview:	.x....?_M..Ub... ....Y.1.wQ[pV....4.......D.....@..Mcn.Dd0M.......E.g.d...........jf...5...V...I..e.mE.^..!.K...8.5d..@...<c-..9.K...f..D......t...]....].ac.......&.H.7...e.n(R:.}..;k..dT>B..S...r....g.......3..........?=.].....`.-...=KL.+....Z?.../9$.......&..w..i..4.b..-.d..]NI.Q....L.....s.m.T<.....Yo_.?,6.%.U...&..._.[G.:.d.\|IY.U .=.cP...EQ.3.y....4..6.....AP.l...R`..r.R.....`%.{.c..[U....1..2...#7...6..]...b.D......h.9.........Nu.q...}.....^p.B....9....4.]..\Q.^,....'h4..P...:n.0.H..o1..L...y....zKh#Hy.R27P.K}..."kqk.p{[.b.CR......25..`'.AXo.A...._.......g.....Ux}.l%.o.K..;.O..Y...U...C....m...-....s...bgnZ.....][x........T..R.V..H.."DHb..#.).fL.......xo..o.W...z.=P_...i..vU.2pX#..P...... ..3h....V-..\.'....B..+...M}S1.Q.L.6...&....pFP../..va......v.....$[4.....<...^..{.....E`..]Zj.}.......\.....w$,/,...Mp.V.j%.b......$...F.... .=.j.....`.Z.H)..T....&'.%....OG....\|L"#...>.4ns....f...........rQW^I..AIH%...W...k..q.E..N..]L...h}/.@..

C:\Users\user\AppData\Local\Comms\UnistoreDB\store.jfm.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	17436
Entropy (8bit):	2.08345014618736
Encrypted:	false
SSDEEP:	96:Xvt1fnjnympl0e6R0cAdqdgIIdC5MVboYFawA://f77l07AdqdFIAaVb1FawA
MD5:	AB0B6129299D2CB863F3AE2CBD5B8852
SHA1:	25F816266F2C00247EB7D020F0075ABAC6E25296
SHA-256:	E21AAD42EE6C37A37287E8A7E701AC429CCB83E16A7680B4C3E9A098005B638D
SHA-512:	95B85C44AA5192FA9583B2C0114C7AB162C94EEB4B88641244F19205FF774E66E5BCC0722A6CCC7C990DE3FA71BE9B4196B32E109559F1C768CB22EFCDCD7B01
Malicious:	false
Preview:	.zjY)....ji..~....l.A...)N..h.%7.......V.......@.Nq..g.......c..U.}..c[.....J$c.nL..H...1_8.....D..=..tW.W(.Mf...Gp.t.....u.%./......Y......M.r.5.\.u.... i`.I'....r.'.~5.Vo.....\._d..(.S(;.+k.1.3.(-.....#..=...C......H..0!j.e5..L.x......RQV.....u+K.....m.a...Q.:.:......!.y.C1.X"..>6/..,S..g...Q2.\|.H`..B..?..f..F<3.#...g.e...v..xl..Zu1..)....\|.K)..M..;W.K.k.....G...j.i.=..E..G.m0....B..T=....R1gwE....t..j..z.z....M....:....&..#.n..f.y...D.y\..eT.q..`.K..v$U..{{.f.J....}..7...G4R..`..@'........'.!....P.8.........ipz.....~........z..+B......(7. z...e........;.D..(.p..O....i..@.L.$RBL'....9O.>...z......{.^.....*%...N......x.t.b[.E9...0.'...........Y.. .W.M..i.<. O....n..H.....K....o_.t.E{..%Qh./.sm....hU...X. po...G...._.9..?W#..SLIH..c#...}.B'...Kh.{...\|7?.HQo.FFK........m.Q.=27.-D&..Ow...`X.7..i.io..j..;..Xu.KqF.fsXv....d.0.o..Ji......1N..........!B..,c....`.O.r.4.A.F1.~..q...@..7?..y.......A.L.Sy.t....r<.I..e...x.......`g=2L,.<..r..FF....?.

C:\Users\user\AppData\Local\Comms\UnistoreDB\store.vol.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	5768220
Entropy (8bit):	1.623574697608231
Encrypted:	false
SSDEEP:	12288:BtOGGbyYXdA1vty7Lv7jXOFTScsROsU0stFikFfwyW2KKG5:BtOGsyYX+FEvv7nR1miKvW2Kt5
MD5:	C8B7520B166F8087779ED62D9A215C22
SHA1:	79CD18F6E557E300C5E1047150F8101D694DDF5A
SHA-256:	D1F18638CB50DBFC216B87D89D55331202D989FB46AEEA0BD5B9679CE0B8C54E
SHA-512:	6A382AB0612588CA9D34605D95E81698B58396DAC71818CE5B17C5B74A662404C993340DD8BAF07661B5F0810D9D60F9BBE7BCD8F458C441053B4A3BEC7A3774
Malicious:	false
Preview:	.zjY)....ji..~..?...[l........q.......Dn.3y..rf..+..8.....=..S.....$..U.hp.#......g.yfL.'.6.Gj.Gm.owF...:.....&9KP.@.r...d.:....UT.]..zz...6..x.ht...X....b..v..&.kk.3. ..,TCT.2.^/.'..\^.........(.MX.....&..E....Uv...oP.......3.Q..D......OP.`!.#l..2..\|"f..-I..Y........K...f3.v.......3G..L..?E^..Q.....-....c\|b.#.<.R.....V...VU.#t..j..b....g.lX/S(.2Z......Z......]T.Acn..@i..V..s{.v.'...&.k...,:.Vd...6....U..'5...\|7.vW{@........;D..-...).N.Y1..6_......e...h.h.....b./......qE..S.2h...e..$....=l..+E.y.%.f.g...,..=.e.<.h`Vw...k..~..S....1.dtW.]..(A1.qI...~,.[a)',.6~..U$B....=a2.5.`..p...v`.....x....S.E.C...V.....8c...-.?`.,...-.....s.k..<..u.:......j....... ...Y..F..S.A.;..t..A....n.f...;.8.....dY.R.G}2J...W..?c..Vk...X.`.o...".....qI.a_..u.o..I..t9....Z?.[[UVu4.ty...un..P....a....^.Q8...*.-P...../[.s.'9. ...Ucf.. ..:.aH8.M.[....).c./.O.P........L......v.G.=.X?U.=8.<..d}L@.._...Xr.?...3..8.....\...%j.."......U./....-.\B>?...k.?;'.j.j.[=...vN

C:\Users\user\AppData\Local\Comms\Unistore\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Comms\Unistore\data\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\D3DSCache\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Google\Chrome\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DIPS.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	29724
Entropy (8bit):	1.9580456738469925
Encrypted:	false
SSDEEP:	192:p6BUdKkswOW9WM0A+5SQwlsqvddqg+y4o:pXKksbW9WMBhhdQlo
MD5:	4B35C611441A5C7CC0DF68AFDEE5C960
SHA1:	0DC4A41920DA12322DF90540A49341B4739305BB
SHA-256:	F2D8C5286C136D6E0E1476503523F3067AC533A960CD4F8583104DF501E14C2E
SHA-512:	8933E75782C1074222372F50F74FF48A638B60E028A79B453317E876AB2807F2FD026453DC393F659E1EE937ED79F0671663B65F7AD65392F79EB1E2EE3EAEAF
Malicious:	false
Preview:	.O.SO.y.R....e.-;.8I....O..m.N.].u.......>..jQ.?..e.y.BC.J.R..).w..ZP..s.~.[wK.......n...4.....&.D...#^ #Z+:...G.k@:.........R...cSn."..K.g.B....=............=.m... ]%M.=...b...8.!..f.>^..?<.#c.2a.V..O.....9.....MU.T.8.S9l..jv..&RNk.F..A..\..E...j.=.B...Z.w..#F..k..FXLo..PNE.HKn.B5...A...9..zI.T$./........>....}.5L.T&.:....+h..........s.n..@7.......v,..t.~..vp.[........P..,.{....6=.mO..8.Y9._..\)j3.;...b.?]..?..R.."&..X...E.F..iR.)QR..&.!/_.I...Mu.APLhT@\|.._.X.]U..xL8\|3;lIi2.N.~.q.....j..9..L....o..f..."V..(.......m}.b.=%:}G..,@6Z../..l....A0.....n..1..+=.._.c'...9.Nx.........^*..Rk..M....ds...A..Tj.<........M.#..)......s.=..c/..z......Ln..Qs.....v..Dp.S.v...Y./}Y..;....F...S...\|....j..z7RF."!.B....pI1o.O..'M{.r..g....!h.V....e...'~.o[...K......P..b.f.\..$..\|.d"=...AN.~N$.\|..W..;....&...:./'9...PBp.....e..V......A6...B...F_W.P.]a...u.A4<...Z...V.q.o.O.^/...+.....7^A.& nD..0.>c>4....}..)q.%.N/HS......C..............,..J.k.....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Browser.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1164
Entropy (8bit):	4.771883581166751
Encrypted:	false
SSDEEP:	24:5e0qYf7QNQK0KbXBgfW/fl2NCg81t4TjVkVYw32Z2WMawQy3rkQaS1:5e/SQNQQBgf82NwAkWw32ZNMF3ks
MD5:	1D3046B666A1FF6D064D91F0479C52F7
SHA1:	9BBB16D8FCA3DB0158C6157C3684B2129A51F860
SHA-256:	28AE66662089CC699EBC9D86768AF21B2E602E8A8CDEAF461E00DF1A807FC133
SHA-512:	BF2067EE67EE5F4B9F367951276F19E426CEC03EF93D0A80DB85226A6E35A8B2C67938946903085D4C9569B96EFE49EB4AAC76301319712DECB2EDB73EBD7A2A
Malicious:	false
Preview:	...\..D..5...?x...... ]......\].mdQ.n.....P(VnUT.9...'F...^......{D......V...%G....I.k."?..5ii.............6.@..a....+.+..---8+8---1539a7b04649e8291dbf69a03a491be156832624bf19c851f85ff2196d3a0e5b3be7ccc0aeedbb0b02627a3be72da0b9a2e8e06ad50e76743b0e6767f13fca9c6143ed6dc4e29c2a65c4e19f6077ff425d5f2ea47c979b0706a5e60f998a775a3d134b7e7b5131f0215134ecaa2561e9cfa59adb13803de7ca07b894c7806db45eed0594039013efa92ad8ec728c22f9c79f60645136d6468e0a7ff3d28b5439321802bf6e4b0524dfdab98c6675cecf719df6302ea342341de79993b137c9ce1ca4e2dd050567f24ba53b1ac62c21eff90e9757d516329decaf8d4b0f221a46d147aae252ea954cb97c4d5d9ada64efc4be2e6ede83ba36aec0cbf6180c6646f74cde0819f5d60b9b21915679f9147cab4aeabd941c251d0e5d972d809c098c5c2906bc70c73e5fc73c0e1cdf3e337ec0e16e3eb08c57b0b6cb84344a3f035e2c9619e5220dcdbb211bc2d7ec2887acc1ff1a19d17b19e6413b194cbb93f904b242096a4d7549e347d39b965fb7c78a52e099615991b5ad6dfb11305bac08e1f38e696063e8d67c3dc709dffcd9bb0b874f7af1f08b808750dfec050ec43e2c8e75308fc2422f572da254eea1cdc

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Version.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1068
Entropy (8bit):	4.251793318106201
Encrypted:	false
SSDEEP:	24:5uf7QNQK0KbXBgfW/fl2NCg81t4TjVkVYw32Z2WMawQy3rkQaS1:5oQNQQBgf82NwAkWw32ZNMF3ks
MD5:	C69BDB1AC61D4FC1707AD11643059E24
SHA1:	945F690D70692646311CAC2A3DF9E39006828066
SHA-256:	B5D7B43DE52E6D6E3B6CA2B4326F37E7E27070CEB10F19028DB5BA7D7B9D87D6
SHA-512:	5137BE15DC86A5451D67F81EB21F826841F141E68367E721EE157C619B358AA1C5254CF606734BE0CD34B78622666285B3C2AF53FBABD42413966415AAF316DC
Malicious:	false
Preview:	...\..D..5...?x...t......2..---8+8---1539a7b04649e8291dbf69a03a491be156832624bf19c851f85ff2196d3a0e5b3be7ccc0aeedbb0b02627a3be72da0b9a2e8e06ad50e76743b0e6767f13fca9c6143ed6dc4e29c2a65c4e19f6077ff425d5f2ea47c979b0706a5e60f998a775a3d134b7e7b5131f0215134ecaa2561e9cfa59adb13803de7ca07b894c7806db45eed0594039013efa92ad8ec728c22f9c79f60645136d6468e0a7ff3d28b5439321802bf6e4b0524dfdab98c6675cecf719df6302ea342341de79993b137c9ce1ca4e2dd050567f24ba53b1ac62c21eff90e9757d516329decaf8d4b0f221a46d147aae252ea954cb97c4d5d9ada64efc4be2e6ede83ba36aec0cbf6180c6646f74cde0819f5d60b9b21915679f9147cab4aeabd941c251d0e5d972d809c098c5c2906bc70c73e5fc73c0e1cdf3e337ec0e16e3eb08c57b0b6cb84344a3f035e2c9619e5220dcdbb211bc2d7ec2887acc1ff1a19d17b19e6413b194cbb93f904b242096a4d7549e347d39b965fb7c78a52e099615991b5ad6dfb11305bac08e1f38e696063e8d67c3dc709dffcd9bb0b874f7af1f08b808750dfec050ec43e2c8e75308fc2422f572da254eea1cdc0bbb8e5696dee5a5e86fca60fa787e2c8f56e62fcdec3fbbd3705910ff48d746def4b4dddeea22022572f7fa90a4e5f8

C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	602417
Entropy (8bit):	6.509421799558472
Encrypted:	false
SSDEEP:	12288:nuVe8THzB+crpddT/EveiJzUuARTQIbaMicFPWZJyg:nuVeGzwAdd4miJgDEUhPSp
MD5:	B9CEF47FA5A2E3263A6CEE059BBF0ED6
SHA1:	BCED21E1AD8641510906C8F8B87FBFD18901CD50
SHA-256:	A457C16C36D408A3F526F543C0A6F7821C928E6134A23F10C85FB7750CDFC5E8
SHA-512:	E44C30E6515A9A60FEDFE2AF81255815A851E41A8CBFA3610E83F0C7168982345937FBC43C11B3C199784D0932202A953C1863D5D07D336A09E1D1A3CACC73D0
Malicious:	false
Preview:	...\..D..5...?x.?....kD.b.2...b..~5kG.%.H~de.5.=..E...o.R.H...=...x.]U.$..m....I.=..`.....xz.....j....\.H...h.>.....K....,.g<{.#..?...G._...n.......@.d&%.lg'.J.u..g..?.Du.^...5.c'a.5.=....e...:..5b...zf.h.F.l...)hP.$.De.:Ug.p3.GJXO]..M./Y.`..b.....l`..=Y.o.`.U.4...d.......I.a@g..)`..{.xxU..$Ua&.{..).q...M!G...&.c.es.[.cV..=.u.!.jI.;&.5.p.....X.]@..-...[........K...E....0..g......MR...Ght~.....9........Z.h..0......B.S.../....~70...iB7.......d.uH.7^..N,.fwX1.v>:(....t.5....`..ou.k_C.}D...8Q...`26J\|.B.@...=....K.@3i...p......Qc..pJ..`+q..?_.......s..r.P@..r.t..AU.....m~@..k-A.R...$i.<.-.. }.J...3.......J)9.\|L)V....[W-03.#..0$....].. e"....p.E..'.._.m.(...H....g..Q.....o.uL....".[.H.'?..GP..].....K..33...F8t.]>..R_ .y.".1....8..#.]T...C.R4..l.U.....7.S.k.$v?..+4...&..9`(.e.2...uv...+.@-J....)d.DD...l:..?........K.y.Y....RJh......F.....S...6.]Q.S..<....(sYB.;Z.!...j..2R.`^...H....o........}x.H....0=.q.J.=h9.Q.*q0 .1........ K.<\|...R.Ut}...R..LzNE{.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Variations.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1148
Entropy (8bit):	4.692370602752403
Encrypted:	false
SSDEEP:	24:Cb6fBuWbLIUqhqYGT4IAMVq7ieA86RH4BYU0Tj1DNUnRmMaS+Kio45tg:CEB5M1GEIAMVq7jsRH4BYU0TknRms+Kv
MD5:	B51C2EB714CDE83A40F8C5DC559A4817
SHA1:	64F6C2ADE1AB6302DC36A3EA8C6F6AFCB1985CDE
SHA-256:	93EACF62E18780169E3D5967331BA5541ED8422F848E73D85351C11D31916328
SHA-512:	DEBC71DC4259910B6ED4E611991BA4DEE74F2615AFFC4A02D3262085FC3BBDDE9EFBFBB15B0D23498E5F97329CF6FFE0783884F0E08EC73D3F49DBE6586F3017
Malicious:	false
Preview:	.n......}..%..NRB.......Y..f......G...m......K_...4N.:.ESh7.......V..b.....L.Vdn..\....VhRp.j.-.q.g_...G.N---8+8---4e8fbd5f78f13dc4058b1204f57f8e699816cda1687f8930bce4ca7a79755f9c50dccf3d3322f074ca702921e063a42ca1c7e986324374056c25d706262f1a6b578e84f61eac66e3d875a62a843810fda07806348c9aef891f3209c637d6bf38634d0c6ccd6f9afcbbd456ac6c2a048444c5caed1c992550dadff6334be2c08954c8573a1468bf4e9c84c397dbc7f1dff203969184b6db106297096ba34e0828a43ba2a9109c72894369760400e835c5832d130991bc648103f4b84cea2e115215f11a0d27a7d3c177dea84331c70f2225bc1154fc3c7cdb19cf2a8bffd1f23d0b1be21f7b7b4785b9529c06fdebc0a1c88c3686ee133265de006cbd2d3117ab17fda0d4cb94d30abcb4ac48a2cbfded513caafecae397eb4efa8a1dcaab514af71a73efda2222bac0b7f02edcebcc7e1d518bc3bd252ee4642069add2fca4174c68640e69fd0424cb4acf8961a2d36c375fa19933756240dd884a3d71ea70a5c16f0ec90b66b758804d8f03f5e0d1b353212419a7f1b51ac5d1b25508580f6302f7517b55cabfdc9f1fa33783999a244e929681a9e7f0736d9772d4de71e4952e59a08cb351b70911b86a9663c2d598f7c105a21ab4c

C:\Users\user\AppData\Local\Google\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\IconCache.db.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	11740
Entropy (8bit):	4.986624819827493
Encrypted:	false
SSDEEP:	96:lyC7XaVApYe/q2mv60O1W3IpKr8r4wRlSJ9XIlEcrmUcr88jPke3gPkUiIgiFNif:lyCHlbEKd87A8WypReua0kAlf/
MD5:	29D1554ED7DC68EE031B38029F538E8C
SHA1:	C8BDC21C0BD47CE450A9CDD8CC0B10320342D164
SHA-256:	D914CDEB827157D31528187F7879F944E22DD5A98E4D2E2181A13896D11F3037
SHA-512:	E520F3B7AAE73A8BDF0654FC72C475BE5358BDF05A7BC4640E75DF0619A61155EE352C6013E3B6C703DB6551A16C7D170FB3405C473561B8112EDCF7B64BB4C2
Malicious:	false
Preview:	..._~.1..~#@..$.7.w....)(...:.Q........k.`...g.9....}."e..CCB../..Vk.$..b:'E ....Q..J....d...$\..6.7W?.....(..K.Q..yl...<.j~.C...{j.1\|..jh7#._."......_i..A'.'l...}...1..0.w.n$.YV"........R.>.`..!......R....`I.z.&.@Hu..wT.....m)X3X%.......Yg6.Y......GA.j..9........D.....>...j.B.1.E.I.P.h.iD@:.....i6.Iw....]....h.`&x.3jJ.4.....}..:.ne.ej}.d.S.D..jh.]85.9...x.....&).s)...2.....P.9\|V.[.Fl])?&2.e...........Q....%.1-.XL..Q.I...M#_.A.<....@w.Vo.e...N....1.r%..X},4.{]...S...CG".b..v^.n.F...;....j....o4..V(\|.K*c.9tX)u.[%..].......<.Hy.Ip{ze..Q-8.^#...\|4B2cA!s..,..oi._...g..%b.9_ScV.,Adn.E..@......8.oDS....C=...I0.[..G.&......8.K.H....o........ZR..1...:2Z..R~.`_.1.Pp..(.^N.......~....!..r...(....x.~B....^).6...;.....!.u.$...'.../..:Q..r..e..K....j......y.....Bf.e..b. B.B..]I<...3.......D.h.,dFR.-G9...6Ay.)..[ ...q.....}.f.(.f.........RQ.1..1$.}.B....[E..Q.BV...g..f. ...tX.:y.....QT..F.VO..b.=6.@..4...V.m.R..Zh!..+.........B....X......is.>...$......

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\ngen.log.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1388
Entropy (8bit):	5.572655771378212
Encrypted:	false
SSDEEP:	24:FVzjdPTsLCncMVjMtCjebDAZmDqrLGFZWGRsTqAc/cFrvCQpcFHJ+uY4ABVIkN:/pjtStCj/ZkHBRsmPcFrv6HJpVsx
MD5:	F9C8223022889CEEF5F65B90D2C9FBDD
SHA1:	4A9F5B5543A3EA22A50D459FC5EB7BAB303C6C2E
SHA-256:	413747FC4325B575593D29808E556FAE9DC200FC68F58F2ECDC1D633567C7613
SHA-512:	4E11FDC80BBD65AB38FDEDE0561D0EDD731FF569BFCC563EB5A6E7F31693BD2BBD5477A26E146B6E62CD073DF076402A52D3075A393C6B1EE1CA02812C00E25D
Malicious:	false
Preview:	.;;Qc....E.8....0...:..~...k.....B.c`.~...W.....BQO.fP.^P.'....}...Z.wo...%..e.............J7...w..K.5m..K:2.p.....b......X......8X6.}.H.T.k\..6../U..6../...nC...O.Z."s....wqBkV.^...M}..R..m.F.>1..>0=..O....z.0....On..&M/r...d.[@:.:...{.v....2.4..V.Rv..:K....+vYB....$..r?cO.$.zc..=.....4A.;....&b~`...P>.l....-7...;.mY...._..M..---8+8*---4dda375acb23efd0ca9111f7df0046d6cd0ef7ef4ab1237ffd9ed69365e49602ec0e95fe59187ec7e93878d26ad3319145c198a51988e4fd9388c9caf03f8daed013ce9b108f512840d7d7f24e038ac1384de1b481eecf89d8f4fe8ade093cc5deedbd3b78dcdab6ca947c313f14716192f06fedc2be4db041040427ea430c0cba566fefac5b1c9f63b3ff2bbd32d2de589a54220d91d1739e9a0195a3e1ad84ac531e0c6294333d4805f536d1edab31b1c8c54a23ca31e993bf42e05fa32a151c8dfd403d094d924547f520dd25da38ee1dc35563c82af4419fd159ddeff7aa6d2a03e027bfa13f9407c0d3b6b04557c6276abc21e025b693f70d8753f27c1db2d37a4c4a3b0848c2c9a27be595adf1255ecd497dade610e49d2a2a73ce2d196093aed53950e4770c722c304490b290848e31da978714e68dd4c8ba3bb25

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\ngen.log.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1388
Entropy (8bit):	5.5989872344138565
Encrypted:	false
SSDEEP:	24:FVz4Q3+sZERjebDAZmDqrLGFZWGRsTqAc/cFrvCQpcFHJ+uY4ABVIkN:/4A+sij/ZkHBRsmPcFrv6HJpVsx
MD5:	5E577AEA472E54AE4D5C4FBA84125749
SHA1:	62A9BACF0A20690D6D2EE86DBC59C9C793EB33D3
SHA-256:	1E9E411285450DE4AB820D3166F6C30ACABDD127588E5271C0F1ABBB8A77EA7F
SHA-512:	A795FEC7B9607A2C444309B14090D27230394F4BE7A6EEA623513C388E6BF237984663E6349C838D6FB7A0710134007F27FEB9F6E5C55854E1863DD88915532E
Malicious:	false
Preview:	.;;Qc....E.8....0...:..~...k.....B.c`.~...W.....BQO.fP.^P.'....}...Z.wo...%..e.............J7...w..K.5m..K:2.p.....b......X......8X6.}.H.T(..T.{.....1..p........X../..X.N.....o{..S..d.V/$.Z..J.Yk..p.P...._..v.....'.........:.1..3S .pf."......?....p...Rx~d%.TlY...n...IV..h..........F.e.&#.w...{3c....g..E.\y..'........{@..1Z.t=.---8+8*---4dda375acb23efd0ca9111f7df0046d6cd0ef7ef4ab1237ffd9ed69365e49602ec0e95fe59187ec7e93878d26ad3319145c198a51988e4fd9388c9caf03f8daed013ce9b108f512840d7d7f24e038ac1384de1b481eecf89d8f4fe8ade093cc5deedbd3b78dcdab6ca947c313f14716192f06fedc2be4db041040427ea430c0cba566fefac5b1c9f63b3ff2bbd32d2de589a54220d91d1739e9a0195a3e1ad84ac531e0c6294333d4805f536d1edab31b1c8c54a23ca31e993bf42e05fa32a151c8dfd403d094d924547f520dd25da38ee1dc35563c82af4419fd159ddeff7aa6d2a03e027bfa13f9407c0d3b6b04557c6276abc21e025b693f70d8753f27c1db2d37a4c4a3b0848c2c9a27be595adf1255ecd497dade610e49d2a2a73ce2d196093aed53950e4770c722c304490b290848e31da978714e68dd4c8ba3bb25

C:\Users\user\AppData\Local\Microsoft\Credentials\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\Edge\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	45189
Entropy (8bit):	6.607673305578152
Encrypted:	false
SSDEEP:	768:mDXzgWPsj/qlGJw1bnY8GB4kkBMEcwuF9h3P6O9Htbzy70FqHoPFkG1Xl3jVzXrX:m/Ps+wq7ynEGtbz84VlXr4CEAvoNeL
MD5:	6A53E91EE1FD18B7B76E5FD0F21015B5
SHA1:	35C838334AF3FC1A7552055D6255E9EEEB9AA79A
SHA-256:	31AFCA2726EB6B2E8E010974CA1AF941BDF52C7EC4DA62BC894946C95979FA7B
SHA-512:	F0ED99ED4B9390A7485CAACE0FCDAFC906AD6156F36E76A228E89917A487ABC19FBCA32217CCF253183A733D11A504929ABD57C3583AD087C63DB3E654CF793A
Malicious:	false
Preview:	C.6aw..h..ET.@.#...J..L.../..^.ox....%.j.......4.'.q`..:.dn.V..\|{..E!U...sJ{....0l.....T~..qR#&.b&.>]x.vH.._....H.8[.m)N...w.....!<<BQ....J.......z.8.fy.4....t..).'. .`....RzA........&..?.e.V.m;.K`YY...f......E..........g.!...W.S...D.!.".{r.o._..B9.n....\|.T.XN......]..k....)..-!.......(NA..j.@.f..w[O......[.fF.<Z-e.h..!.0'`...oN.....xJ........~.e...M9-......SyAk9.W.Y...!..:.....Ldf...oC\.J.K..X...._.Q.>.G.~6<..z.K.&a#..b.. m#p...q..J.........\|n....S...gU~.(4....G..-j.F...#..#..Q.r.cS.a.ML..=W..h E....ce.K].......h.O,..f..x..j9.!..9(.......)s.N.7./M..y.k.M....F.B............QoI.3v....\|....sz..O8"....$..-.B.d%......L.A......gI..C}<a..mtQ......4...d.!...3..G..<$.....8.hFbq..Y=!.LI....e"h........6....?.T).O.b.{..Pa0"...:.....n.L...\|V\.......ui....@..XQ:s..U.G..7Y.7.q.t.>.{..3.C.H.$+......g..lP.}He..+$q.`>}..\..V!.C0.......=4_.w8B_I.+<'..S.......Z..N...2)...W.......gJ....o.fj.lFz M..1. f?.......<...=.'.0.2.....#...T........\|.YuF.-.5wQ.....k6.[w......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1148
Entropy (8bit):	4.6851404980331175
Encrypted:	false
SSDEEP:	24:Hmdk3LoGG73cYjdwZxZdfh3O/aQ8FKiB+E/zTT:EJ3HwZjhNGqLv
MD5:	E3BA3877A2FAC7E043881E30E16FDFE4
SHA1:	744B619C187FCC77C211E5ECD45F31AB49D15104
SHA-256:	93BEE28F245EB6C34C2A6889018D48033989D2B450B07DA8DC825700EB8B2369
SHA-512:	491EE6037B4CC3FF8CB86DFA7B217CFFE986431BE744FB4F0BFD0B4F3183C8AE5FCD796A2AD0C464C1B813B91B892302ED0F8530743337D3C6C9BC0E9E1EFC6A
Malicious:	false
Preview:	P.nV..}....E...O98.L..g.0.&....\|....WRr.K..^..QM..h.....D;J.....N.r.d......K@..H.l.N.3.4.F..W.X\|V.-.---8+8*---b633e03c742159b10846a3f1a49d0548a2bb790c7850e8081ee9d61544b8867a109cb3caab744372e03922b4049d4b601c257158dfce952620b639f0973a94ca51c57b2f9eb5bc16ffbd24b0f06da612a7fd3acc13c7867757d67caf15f74963668afd6a86f7f7a833157ac42cd14e1b6b442e37ea1489fdfa94133c751116ba242044d111965cd848f7ef71932efa1aa0d6532c492157ac0f58e01b35aa1c5deeed79f0e0b32bf1a5913881b289822bf6d937f26b6fe31b69de2f177ae35e3f1306b798cd8da4f572c2a33c4958c7dcc5664fa2f6e6ba50111e5b5cbd269643945a68258e7fa89e42e9d678f9db382f4bcb82e86b46c94782cee4740f125b9649a054991730a4b6303f9585508697a0396d8c0c8a84bf80c35f717b307e5cfe2ffb0719e539be251ad1b57bb68601f2bec008539ca0e2704b86aa6898acc85e66777628a925b4e7dc08e2396b7dcb34d3155a09b0ba7414292347f9ffb07565025b02cc394cc569648887a2560c3d6a9a10a4712b54105e918b6b26b407386c263f3a7e9abdce2e1a10898361b00d6ceec0e049f732c83728e60ee28b0456c09b75f1aceaa1e48f4fd6fa441b1034cf1519f8a3d0f40

C:\Users\user\AppData\Local\Microsoft\Feeds Cache\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\Feeds\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\FontCache\4\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\FontCache\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\GameDVR\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\Media Player\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\Windows\History\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\Windows\History\History.IE5\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\Windows\History\Low\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\Windows\History\desktop.ini.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1196
Entropy (8bit):	4.9469458041962975
Encrypted:	false
SSDEEP:	24:sqxDmRsLDSNZVIlYMj2iE7XailWxWUMQ6WcsRIWIqLa6Usjto:7xDmRs/HYMyiewWUMQfRI+zto
MD5:	5CC18275A34A479B6689E670906571B3
SHA1:	F45EE523C0FF24733C02896B50BBEF673DDD82FC
SHA-256:	6DA24EE3756B63D2A811ABFA4422BFF873DE0FB3BB30D2DDB36D2B7DAB8A8D45
SHA-512:	72C34DE3F9D3E24C633796A4F070E693D30D49E1027E6EE73CF603085709B1C4EEE1C54E5FD86B2EA1FC9FA04A852C067F5EAE65315B234077E116C3894B1581
Malicious:	false
Preview:	~.q.._t.\....t&a.o....\..K.H......w..w..kx.ISa.....\.._.>.....OO.u.J.......tn`a.$.3...@sa..M.B.y.......s.l.h)gY..qu.ij.....pI@V.....r....!...GWS.TK&.---8+8---3910a80cb7ded3a0cf716389c07f3441cd5f6817ecea41a0318571367806ab3524823940a936e681c23f617944fd26b0283e4a1470776e64b023ef883fae7d85e1dd6636dd332ee25b3219eae419942c7e522bd0f35dd3fb049f5f5d48c7d49d20155f11521984ee3cfb53bfb14fe4ec1321c50db4025d9ebe257917b6263c6dc87f2ccc50f095f787be1d683589031ae57930980322c913901e884d780417f072f11d9510db18fd7c747a697f009125ee3b800e374a7f55f174150f845899ad42bc697f555d242c28108bced59804e15cf43aae1af2bad13f9c0015167aeac56d3c6a4f720099610e3bba61332e110e42b13ff1d49005862f8c6e92d421fe8b8bba9817d406b7079f6256060ed71970ec09ba2babe089a6dbd64011a17f70d157da19ae6dcfe3bd1f5638c08826159cb9591e76c23b97a383baa020745a14aaab453a7d19996ed71e1d911f41c5992c4c946433d054416c7c53bdb29ecbcfe5b4ed74e3f8589029c5c243386168b5bdc8300b62bd580b0852bfab0062793bc28b9191d9f51e4216cd47577d5e4aa1c08aeca14da20b808a432abeb8e4517

C:\Users\user\AppData\Local\Microsoft\input\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\af-ZA\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\ar-AE\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\ar-BH\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\ar-DZ\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\ar-EG\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\ar-IQ\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\ar-JO\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\ar-KW\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\ar-LB\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\ar-LY\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\ar-MA\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\ar-OM\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\ar-QA\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\ar-SA\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\ar-SY\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\ar-TN\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\ar-YE\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\bg-BG\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\bn-BD\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\ca-ES\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\cs-CZ\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\da-DK\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\de-AT\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\de-CH\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\de-DE\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\de-LI\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\de-LU\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\el-GR\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\en-029\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\en-AU\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\en-BZ\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\en-CA\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\en-GB\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\en-HK\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\en-ID\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\en-IE\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\en-IN\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\en-JM\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\en-MY\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\en-NZ\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\en-SG\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\en-TT\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\en-ZA\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\en-ZW\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\es-419\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\es-AR\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\es-BO\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\es-CL\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\es-CO\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\es-CR\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\es-DO\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\es-EC\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\es-ES\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\es-GT\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\es-HN\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\es-MX\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\es-NI\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\es-PA\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\es-PE\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\es-PR\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\es-PY\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\es-SV\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\es-US\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\es-UY\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\es-VE\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\et-EE\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\eu-ES\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\fa-IR\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\fi-FI\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\fr-029\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\fr-BE\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\fr-CA\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\fr-CD\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\fr-CH\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\fr-CI\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\fr-CM\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\fr-FR\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\fr-HT\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\fr-LU\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\fr-MA\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\fr-MC\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\fr-ML\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\fr-RE\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\fr-SN\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\gl-ES\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\he-IL\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\hi-IN\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\hr-BA\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\hr-HR\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\hu-HU\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\hy-AM\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\id-ID\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\it-CH\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\it-IT\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\ka-GE\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\kk-KZ\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\lt-LT\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\lv-LV\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\mk-MK\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\ms-BN\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\ms-MY\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\nb-NO\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\nl-BE\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\nl-NL\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\pl-PL\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\pt-BR\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\pt-PT\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\ro-MD\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\ro-RO\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\ru-RU\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\sk-SK\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\sl-SI\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\sq-AL\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\sv-FI\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\sv-SE\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\tr-TR\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Microsoft\input\uk-UA\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Temp\.ses.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1116
Entropy (8bit):	4.535639671256956
Encrypted:	false
SSDEEP:	24:g6hn3eHux70A7GSZcPmEBdSlfIZPyUzzrRHmT21de+G:3uO1XrZcPx/QfnUz5HJ1de5
MD5:	07719350E2FF0F5DBB8727B3DB351CBD
SHA1:	40650E428BE3939440CB4A8F251E33B6BD32560B
SHA-256:	D3611D2FE328D7757FA89E3F95170D51C1D6AC83CFF257257EC29FE8F9D16E53
SHA-512:	ED86859DCFCBBCDA45970FEFABC31815203D11F663A4F0F01E84383D5BDA503136856E2DDBCDBE5B899210D42193A2DD370220458ACC81AA2B5945CD7313F17B
Malicious:	false
Preview:	.......`].E...9...."...6..... k..^/.Sv...fK..T$..".........J&-.""?)...&.A...---8+8---403f5d9176fa91a26ae1988319e427037a04dc8c8847a94a86e9b3bc6ff67bbcd0de5b9cb84797c415bef23abc9f12d4e62d5d3b98487706c77d3581c8ca3e13a2f672f3acbb85f20efb95550448b2a9b45d58d6b6a25db915e63bd8666657e85c012664b0e225c10f68945f6e2bf167ef19c2757cedbac3c88f3b69652780a97cfc2f8894edb5b250dd5029c91dde1c1eeddb3cd1bf18119befd7c037bec2db71c1df4546e45da6ffd7853d0c3843defaf63ac16d2938d7c14279232e43d7a87fac3159157a884ae12ff59c1f6550cf683866062651df2e76c46b16fcc4ff08b18e54c0e9a0d33ab2a25ddeb496c02001606497909b55cde56207e49c6b3f2652a45cf3560004b993841015147bad8824a4a3e567e2bd5ccc5510a947b85c6699d9b045f9ce71fcdebd8cb4afa73cae7d5ffcf521d574012ccdaf6b6d871daae40144aed34d6c7770ca133ea8bd94e196974cad438ecad964160fb7ea30de434fcf30dcb55d39d9fe187603460f50e33b08b8be561e3d2df4568a141debb8d689e4ecbda822f2651b3b04d517b5555dddfd2453aa72a047923ecc1a72bc218565c7794a2cafbfd739c7854df983c91c0a0107affa6c654025af739f0934173bd950cf2ad2af8

C:\Users\user\AppData\Local\Temp\0353475199.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.025239071307774
Encrypted:	false
SSDEEP:	24:govKhHhLlqNIEZerhn3eHux70A7GSZcPmEBdSlfIZPyUzzrRHmT21de+G:CjsIEIuO1XrZcPx/QfnUz5HJ1de5
MD5:	6A03E61001762595D12DBCE3B35106A4
SHA1:	FB2446738FFFB95F827ABC3DAF090ED20CDD4A4A
SHA-256:	D1E89090B29AED2FEFA4E67D5D964FD49BDBBBAA169AC396987901C10E42260D
SHA-512:	7831AB3BE666268D2DC8B117B0AB136063086C07273B4DBCFE19D9C25A3DC9EC207627670B69F7B90D9921483676FDA034004AF971DBA51926750AE626AE2FAA
Malicious:	false
Preview:	.......`].E...9.8^.p.n.[l.X.:..5."...$.U=d'."P.;yI.;.JN@F....J..v.xM.mOG[z9.........A...,.......&+........WD._z9W'.c... `"...T... .$.m.[..RE.<..=.`.,...0}.{.B.\..z.......X.w.....}v.y:.....2..+..L;."X..,DBIN....T=....?..A..Y.N...1....y.y....3..b.!..G..Y..@f(.w......=....'D(.X4.{.]..VLT..>..9Tnt;su......_L...z...9..`............\..l.8.t......... .mj..(...=....F..pE.....;...'.D..O.S;94.[N.K%.H1.b.y....3.....B..~..=..5l...X...s.Bk.T...9.....K2...\>.{mX....z....f.K....@Y.V.....u..[........$...."un...`..---8+8*---403f5d9176fa91a26ae1988319e427037a04dc8c8847a94a86e9b3bc6ff67bbcd0de5b9cb84797c415bef23abc9f12d4e62d5d3b98487706c77d3581c8ca3e13a2f672f3acbb85f20efb95550448b2a9b45d58d6b6a25db915e63bd8666657e85c012664b0e225c10f68945f6e2bf167ef19c2757cedbac3c88f3b69652780a97cfc2f8894edb5b250dd5029c91dde1c1eeddb3cd1bf18119befd7c037bec2db71c1df4546e45da6ffd7853d0c3843defaf63ac16d2938d7c14279232e43d7a87fac3159157a884ae12ff59c1f6550cf683866062651df2e76c46b16fcc4ff08b18e54c0e9a0d

C:\Users\user\AppData\Local\Temp\0615447233.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.051516756716878
Encrypted:	false
SSDEEP:	48:28EarvSma/EhyKTjpuO1XrZcPx/QfnUz5HJ1de5:tgm3yTO1uPx/EUr1K
MD5:	523BA06C4354E8538DAE58062BF556D3
SHA1:	9278CF9F270A6D4DABFB3DBB222899D28C0C3E06
SHA-256:	EFB41BAE779A9DBE6B2BFD9D037AB9C31D004FC43E67223107BB3B3565FCC9B8
SHA-512:	1264B95198D543AC115BE1F452511928E9D7174E5EF9215E22F7935EA635FA795F5C0FB735762E5F08458D955586EE988BE70E7990405B0FE25260E2600D718B
Malicious:	false
Preview:	.......`].E...9.#O.,.."=M.<P.0ng..B.d..u......&..B..U..B..{R......z..J.5......F1..n..k.......P`......d....'g..q...?Vi#!...Ww.....J...J..,..:Z-v.5...W..[L.]....l.....y..1s....1...D.8v...o0.q.^..b=.A.....:....8..Y.&..ku.)....ZC11N..f.iP\..C.[S#.j.'.5.._...j.b..8.\<.g.)vD..%s.........+....s.\|&.8..c.4....Z@V!Q...v.H.b>..@[....z....b;...O.HL..bH.....)J.W27.......w..<.f..S.......5.vt...L..M.r.g.X.......1uDD..h.=.........].m..j......O..u.....2.%..).a...o.p..dw...[."..a.:.R]..i....S...X..Eu.^......)---8+8*---403f5d9176fa91a26ae1988319e427037a04dc8c8847a94a86e9b3bc6ff67bbcd0de5b9cb84797c415bef23abc9f12d4e62d5d3b98487706c77d3581c8ca3e13a2f672f3acbb85f20efb95550448b2a9b45d58d6b6a25db915e63bd8666657e85c012664b0e225c10f68945f6e2bf167ef19c2757cedbac3c88f3b69652780a97cfc2f8894edb5b250dd5029c91dde1c1eeddb3cd1bf18119befd7c037bec2db71c1df4546e45da6ffd7853d0c3843defaf63ac16d2938d7c14279232e43d7a87fac3159157a884ae12ff59c1f6550cf683866062651df2e76c46b16fcc4ff08b18e54c0e9a0d

C:\Users\user\AppData\Local\Temp\0666563528.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.0463210881031255
Encrypted:	false
SSDEEP:	24:gtQZ/FaaNBL1QRxSJ82hn3eHux70A7GSZcPmEBdSlfIZPyUzzrRHmT21de+G:JFBHLcg8wuO1XrZcPx/QfnUz5HJ1de5
MD5:	E316B064A241473E93D201D0D2572B1E
SHA1:	167425CCFB03E3AC4EE67E98AA893F186685FC15
SHA-256:	96FCFFCF809484BFC6DD25FC8E2C3FB2C9B2CD20762E9BCC50FFFCD8F7EB7041
SHA-512:	A87D06EAA10CF680D379AC7362A5A5E9496E4B933BD9AF91AB3F14531178D54B6E594F7F5E16DD4E19CE1701BD293050B20F2A08DBC441D3B9E8B7FB705D3968
Malicious:	false
Preview:	.......`].E...9.p.......}./6_@....V.>...l/..@..-7..4l.Z.!.(.~.+jM.......Q.V0...+.C0o`.wH...%_....,kR".........ko.?.R...L....+a..e.?.4...H..4^.S.P..Rw(.U...u.F...:...[..-e{...SV.......h.@4J.(. Z.M3"."..f.K....$.Q.v....U...9;..'..1....K.............y..pa.....U/.....:....{..=[Kf.?[Wml... ....E...........pd.V............tg.l..Rs....i..6KP.G\|..e..\|.X..R.7L.-..............2...b=`J.........v\....b....rkM..c.v@..4.cp;DeN2...)M..A.....fy......O..~. M3.......Dk/.#b.}.O..t..J..h....GY....h((4x..g.....---8+8---403f5d9176fa91a26ae1988319e427037a04dc8c8847a94a86e9b3bc6ff67bbcd0de5b9cb84797c415bef23abc9f12d4e62d5d3b98487706c77d3581c8ca3e13a2f672f3acbb85f20efb95550448b2a9b45d58d6b6a25db915e63bd8666657e85c012664b0e225c10f68945f6e2bf167ef19c2757cedbac3c88f3b69652780a97cfc2f8894edb5b250dd5029c91dde1c1eeddb3cd1bf18119befd7c037bec2db71c1df4546e45da6ffd7853d0c3843defaf63ac16d2938d7c14279232e43d7a87fac3159157a884ae12ff59c1f6550cf683866062651df2e76c46b16fcc4ff08b18e54c0e9a0d

C:\Users\user\AppData\Local\Temp\0887538035.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.05906453038754
Encrypted:	false
SSDEEP:	24:gEEf+/B9KnNSH2hn3eHux70A7GSZcPmEBdSlfIZPyUzzrRHmT21de+G:if+7KnhuO1XrZcPx/QfnUz5HJ1de5
MD5:	AA6CFC45ACD543501553D52004D99241
SHA1:	5110C47684B0D3B50B26DBC86C1CCF16A5705CCD
SHA-256:	D41B41C6ED5FB6D867654C3AF18EE976E42C4C5F934B948BE7E4576C0BD7DDBB
SHA-512:	33819159118C13FEECC147709D01128CADA76DF65564EBE9BE51D74575E1DA11D68ADB87D47122E7B6C4E0B63238456F720D0F467489C72F9837882604827021
Malicious:	false
Preview:	.......`].E...9.BO.F...x.....1.......54.E7;.........:..!..2.P9..+%uT.....?..M.RP.A?p.....>.....$3 ..>-='...R...n.#+....e'r.;.....F.b........<.>D....{..eI....n.....wY.mF......5..jn:P....].....%n^X..(.'r....?.\..z...YJzJR..@..~....U..Y#.....]C.<.}.....J0.N..8._6?..~k>h....g....S.;-.5$... .:..)l;........`.f...Z..,..L..7..\..........i>..C.y..../.@}.,..r...........o....$.5zd..k.6bY.......\x...@...31.......]Uc.%roR.7,...w...../.I....U....K.c.A\a.LA.......~...8&............t.:/........"...&yv..---8+8*---403f5d9176fa91a26ae1988319e427037a04dc8c8847a94a86e9b3bc6ff67bbcd0de5b9cb84797c415bef23abc9f12d4e62d5d3b98487706c77d3581c8ca3e13a2f672f3acbb85f20efb95550448b2a9b45d58d6b6a25db915e63bd8666657e85c012664b0e225c10f68945f6e2bf167ef19c2757cedbac3c88f3b69652780a97cfc2f8894edb5b250dd5029c91dde1c1eeddb3cd1bf18119befd7c037bec2db71c1df4546e45da6ffd7853d0c3843defaf63ac16d2938d7c14279232e43d7a87fac3159157a884ae12ff59c1f6550cf683866062651df2e76c46b16fcc4ff08b18e54c0e9a0d

C:\Users\user\AppData\Local\Temp\0939541263.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.012290402895154
Encrypted:	false
SSDEEP:	48:3jMPEaK60OK5guO1XrZcPx/QfnUz5HJ1de5:THaruO1uPx/EUr1K
MD5:	346A49702DA3F083653AA4EDE0C28976
SHA1:	83C9D8E874DEBBE0645CD320E118A00C8F3EA0EE
SHA-256:	E6A7BFEC7B3B1A039A882E02B70D4E46C11F09D0CBEA3CC1CEA57755DF4FD20A
SHA-512:	EEEF80E283753CECBA54349DA83137298FD257EE90F63BBA4921A72DDFA2B417D56A86798676272140CB87EA404A2DAB404C5770E3E5B1181DA0216A02345E6A
Malicious:	false
Preview:	.......`].E...9...Ts.I.U...?..@s.HA...0M,z8WdO.Z.!......a...^.......X.......IZ2.Bg..m.....]...'.......ts..I^.9n._.E.H......g.\"H?..g..=9.q>wo.L.)-Z.I.....G.9.Q....NI.<......aSE..gP...H..!....[P.......Z5...#..33Whx.n...S ..%.9w}..d...5S.....1............I..h....xx<.4......8{.x..,$...-.@.+.^.n..z...(..`..e5...y'4......H8..............W....d..Y.u.....A.A..z.D.......5>_L.=1..U.\....(.'h..\...xo.;K.B.w.U.@9.2....1....\| S....^..nY..oz..m...l....Z.f.%..8`+.......< 3...U.Eb:..c.e\|c......!.........y.....8x---8+8---403f5d9176fa91a26ae1988319e427037a04dc8c8847a94a86e9b3bc6ff67bbcd0de5b9cb84797c415bef23abc9f12d4e62d5d3b98487706c77d3581c8ca3e13a2f672f3acbb85f20efb95550448b2a9b45d58d6b6a25db915e63bd8666657e85c012664b0e225c10f68945f6e2bf167ef19c2757cedbac3c88f3b69652780a97cfc2f8894edb5b250dd5029c91dde1c1eeddb3cd1bf18119befd7c037bec2db71c1df4546e45da6ffd7853d0c3843defaf63ac16d2938d7c14279232e43d7a87fac3159157a884ae12ff59c1f6550cf683866062651df2e76c46b16fcc4ff08b18e54c0e9a0d

C:\Users\user\AppData\Local\Temp\1169381505.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.018494940092097
Encrypted:	false
SSDEEP:	24:gXzuVlsMK76RqhbEgh/LNhn3eHux70A7GSZcPmEBdSlfIZPyUzzrRHmT21de+G:eUC6Rcogl3uO1XrZcPx/QfnUz5HJ1de5
MD5:	4199F7F069AA280632CF5114E797474F
SHA1:	62F645F2F95C3FA05302599FC65E3CD6C837E5F0
SHA-256:	91FEB185DCBD60311816E1BD265A649A73316D96DFBE1B4E49CB4233DDECC34E
SHA-512:	EF33D64AF6628A8BCEC0F83CC7DAC170000E43F33518C858D673F92D00E87FDE8FC26D44995A0DC42EADDF94E40520D6150545089D7B17C56D588EA665E543E8
Malicious:	false
Preview:	.......`].E...9.Z..Clu.1...G"../a4.Aax...\....o.6........us/..n......J>DR..#...1....R{..g.(......l........R.......}:..@8...`p.q.....o.R.93c.C .1.Q..u.Xf..4H.8.#....F....n..Hk..e+.}.....r@.)....Lwv.4.^.G.c#..../..U..U.F:..{.EM.D"Oy_.....0).%.....0.J.j..1.s.;......%...vD'7+.........`...`9q.n...nk..vt......Z.b.,3....G2...t.?.k...^'z..)N\L......zM.E..W.....L@j..a.t0W..EIV...N.p..-..G....5.q.)@En.;....6.IjC.....`.....A...l.C.M.!..I ....l.0.=....O.z..Y..c....<:.y9#.p.?...(..u....f..........ZD.6:...0.~..---8+8---403f5d9176fa91a26ae1988319e427037a04dc8c8847a94a86e9b3bc6ff67bbcd0de5b9cb84797c415bef23abc9f12d4e62d5d3b98487706c77d3581c8ca3e13a2f672f3acbb85f20efb95550448b2a9b45d58d6b6a25db915e63bd8666657e85c012664b0e225c10f68945f6e2bf167ef19c2757cedbac3c88f3b69652780a97cfc2f8894edb5b250dd5029c91dde1c1eeddb3cd1bf18119befd7c037bec2db71c1df4546e45da6ffd7853d0c3843defaf63ac16d2938d7c14279232e43d7a87fac3159157a884ae12ff59c1f6550cf683866062651df2e76c46b16fcc4ff08b18e54c0e9a0d

C:\Users\user\AppData\Local\Temp\1244065654.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.048066616008636
Encrypted:	false
SSDEEP:	48:qQDS8olA1iokXiuO1XrZcPx/QfnUz5HJ1de5:LBiokNO1uPx/EUr1K
MD5:	68C140D579D6CD877CB6C27B313F03E8
SHA1:	D226F6AAF450C5957CF5D43EB75E4C1B0913D638
SHA-256:	D8A2D5C123D059A23259518AA51275A01CC505EBF1AF3FB61815B5CD8D48F90E
SHA-512:	0B2777BF4F5E6803E6A70BDD9052F9E485FA6712C0457118D261769F0443FB4F53F69D54A62B26CD7CE76496DEDA62D1C8B987F84DE3255FE02E8D628B1CD104
Malicious:	false
Preview:	.......`].E...9.[.R~...)..,T. .P.y 2Vhiaw......~d..F.>...S...(."}`.....'h.j..JI>Q.r.n].....TZ.s"...........',.=\s.##%.....eD....~....8EM.P.....61.....H....`...-......}p.M...c.fr...R..P.k...1...60F...[...AU@..(..u...Z.....D.e.>..en`=ls.v.v9.k.J.K......ag..G..n..l..}..sDw...Z..:.d^.U....R..EV/n.,........7.+5....C@..#b......%YJ..'........l..x....S..-....aL...F)...G......dE...`......C......X.d.V\.<..........m..^ 6.9.gR.....69W.8.d,....rT....&q....+P....C.5.O...WQ^;z..w.Y...@. .q6M.!L.yr..39:\...;8---8+8---403f5d9176fa91a26ae1988319e427037a04dc8c8847a94a86e9b3bc6ff67bbcd0de5b9cb84797c415bef23abc9f12d4e62d5d3b98487706c77d3581c8ca3e13a2f672f3acbb85f20efb95550448b2a9b45d58d6b6a25db915e63bd8666657e85c012664b0e225c10f68945f6e2bf167ef19c2757cedbac3c88f3b69652780a97cfc2f8894edb5b250dd5029c91dde1c1eeddb3cd1bf18119befd7c037bec2db71c1df4546e45da6ffd7853d0c3843defaf63ac16d2938d7c14279232e43d7a87fac3159157a884ae12ff59c1f6550cf683866062651df2e76c46b16fcc4ff08b18e54c0e9a0d

C:\Users\user\AppData\Local\Temp\1343496627.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.0441794331844045
Encrypted:	false
SSDEEP:	48:nZAg0UvrSQuluO1XrZcPx/QfnUz5HJ1de5:arCrSQuIO1uPx/EUr1K
MD5:	8AF34B248CA2282F4764F8DD09E43F54
SHA1:	E88C030619364D013A4C3509125F245B0258D87A
SHA-256:	056013BCD3473EABE57573EFCC23E61179D0652E5C1453EBEBBCE5E94303079E
SHA-512:	1A60B5722BC73E4162F6771E5A92AEAB002398B5F02BFB353FD071043602E65F1CCD782980B0C6C0965A342CA7F61708C41E3B862EC3E8A778F9959B676342BB
Malicious:	false
Preview:	.......`].E...9...crG..I!M.G\|.._....%R..z.~..G.....A.6.8../...x.D.5...s^.Le..c...7J...adN...x[,.c,]..g~.?.\|.v..8~.....w. vTK..../...z..[..O.u...r.1_.f........"...k.IO.Q....L0.=...&....t.U.\|[.......f........}..B.;.:/.?.B#..gk9..1..V.........a..R.]:`.`c.w..I..'qz=..P.@sZe...b.@.1g.w..}..xU..V.0....lO...1.\|l\......T/<.9. .....Sy...#....W....A%?{...v..Z..yQ..j.m.....h........z..{.40.l.......S..[0u...Q..S.......\|..)_....x.{.........c-B../...^q.....c...b....!y..K.... ......s.4t.p\..j..5&...h8.H....k---8+8*---403f5d9176fa91a26ae1988319e427037a04dc8c8847a94a86e9b3bc6ff67bbcd0de5b9cb84797c415bef23abc9f12d4e62d5d3b98487706c77d3581c8ca3e13a2f672f3acbb85f20efb95550448b2a9b45d58d6b6a25db915e63bd8666657e85c012664b0e225c10f68945f6e2bf167ef19c2757cedbac3c88f3b69652780a97cfc2f8894edb5b250dd5029c91dde1c1eeddb3cd1bf18119befd7c037bec2db71c1df4546e45da6ffd7853d0c3843defaf63ac16d2938d7c14279232e43d7a87fac3159157a884ae12ff59c1f6550cf683866062651df2e76c46b16fcc4ff08b18e54c0e9a0d

C:\Users\user\AppData\Local\Temp\1387277564.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.03324453487167
Encrypted:	false
SSDEEP:	24:ge/1uk1moTRM+gdWLYyB7hn3eHux70A7GSZcPmEBdSlfIZPyUzzrRHmT21de+G:L/EWNFuO1XrZcPx/QfnUz5HJ1de5
MD5:	A18FAB86D6B79482C85934250A01E6D2
SHA1:	96562C7B58B559AE0FFB79F1ED113F8B1BCD34D3
SHA-256:	A28E282397CF0C684764E48AD3DB1092C4C04871E701F207093B8C2A0EDD7951
SHA-512:	5595BCB3CB75D45F671B4E95FCE033B1C436CB8B15109B85104B872B358C62F4DDA59C1E2301F323DBA5740D39946EFE9824EE180081C63B556BBD3A4A58F3F5
Malicious:	false
Preview:	.......`].E...9.....aj...s.p..r.......Z...[..7......Y.R.q ..2..#[ t.V1.pm..DB."<-8`.`&.........E...:S.to.&..Q...G;\..:.w..>..+\|._..u."J.T.....T...H_.iCs......m...k..=....J.k..0....>.9V2..Xy...I.#....sI.J.l.gY.lW..t\|f...w.c-..U..X..._S...O...3}4.lc..+{...0.]{..,\(.>D3B......j/.S...9....~j(.I.E.,....U.....D..h.@....!1..hg......gp.3..+....o.......3..D..2W.f.../"V.d6...].M..x..G.fY].5..-..PP.\|l..<.;..PC.g..W........R.{M3.&.w4.\..7ss.i}.N..8'O.;D..5....y.hx...nc.x...7.....Cw.$.v~...C..Fs......FB.2.Pu.pQ---8+8*---403f5d9176fa91a26ae1988319e427037a04dc8c8847a94a86e9b3bc6ff67bbcd0de5b9cb84797c415bef23abc9f12d4e62d5d3b98487706c77d3581c8ca3e13a2f672f3acbb85f20efb95550448b2a9b45d58d6b6a25db915e63bd8666657e85c012664b0e225c10f68945f6e2bf167ef19c2757cedbac3c88f3b69652780a97cfc2f8894edb5b250dd5029c91dde1c1eeddb3cd1bf18119befd7c037bec2db71c1df4546e45da6ffd7853d0c3843defaf63ac16d2938d7c14279232e43d7a87fac3159157a884ae12ff59c1f6550cf683866062651df2e76c46b16fcc4ff08b18e54c0e9a0d

C:\Users\user\AppData\Local\Temp\1417002460.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	5.9932597023772125
Encrypted:	false
SSDEEP:	24:gSnhCzuQLZYLDuTcpuw0Jm/yABhn3eHux70A7GSZcPmEBdSlfIZPyUzzrRHmT21K:jVQLWLQwTuO1XrZcPx/QfnUz5HJ1de5
MD5:	D78548C3DFA4A2CBFF89A4ECE7471CC0
SHA1:	744B7DFE9F4FA16CFE3552E4B2AC94C0DD1D993B
SHA-256:	BABF2C114B8D254A23F12EABAF07C1EF17102B5F3F64AF6ECBFDE8F2347741F2
SHA-512:	D9D72207357D58798E1D5458C4C9D2176715C2465963AF0F70524CBDF949ABC993F75EE5CB4272D782DDD2974E0725EA49D4D119B589A50FCC8230FCD444BDC4
Malicious:	false
Preview:	.......`].E...9.e..k.........6.t.Y...B.&.cw\...w.wf...sP....../.F.GUl..\......wW..m-MQ.v..j..6P.........N.....q../&...5]naK6..!@.5..Pl.....L...^rm.2.9.U.....RU_..5..3B..3m....)R....h........Oj!.~..2..-}..P.Q..[.k..6..v....[M.`.9f1Ik..+...pc~...p.P_..d&8y)i..V./e...P[AP....5{.w%U...^}.Y.."....%..0.....-p<..+.....WY}..c...i ......_dZ.Nh..r..5\.b..Wq{ >0!....)O`...Z.@.2.\|..).....$..7O..$;.^`.........X7Z.h.......\|......c}..x.7oB..1.'...!fX..u.9..H..4.M....b,.O.e{...3.A,......I/..aX.a.4:.{....0......:.c.Or.---8+8*---403f5d9176fa91a26ae1988319e427037a04dc8c8847a94a86e9b3bc6ff67bbcd0de5b9cb84797c415bef23abc9f12d4e62d5d3b98487706c77d3581c8ca3e13a2f672f3acbb85f20efb95550448b2a9b45d58d6b6a25db915e63bd8666657e85c012664b0e225c10f68945f6e2bf167ef19c2757cedbac3c88f3b69652780a97cfc2f8894edb5b250dd5029c91dde1c1eeddb3cd1bf18119befd7c037bec2db71c1df4546e45da6ffd7853d0c3843defaf63ac16d2938d7c14279232e43d7a87fac3159157a884ae12ff59c1f6550cf683866062651df2e76c46b16fcc4ff08b18e54c0e9a0d

C:\Users\user\AppData\Local\Temp\1796052464.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.024314230501069
Encrypted:	false
SSDEEP:	48:xg0bEGFYpcp3huO1XrZcPx/QfnUz5HJ1de5:lFYGMO1uPx/EUr1K
MD5:	4AE161078BF52F99EE3666E2D550A2D3
SHA1:	C9C5947E97FC10AAE00289CDCC961BBC34C16D65
SHA-256:	FD5DB09E511FCFCA1933D5608304EC9786330597D5D69F05C15CC5E3578BCB52
SHA-512:	46ABDE89BA6AD36715E45C00089684BDC3AD294A6C37EF3AEA845F928E23E812C56A1599EE9AF68BECF3A9C0294D71EDD8E11446B285C028C803F639ECD764E9
Malicious:	false
Preview:	.......`].E...9...T.wx<.YGY.5.\|..}.~...u..ws...4...<.\|.z.......8.....Y#NK....._.g\...!.N..` ..Y.v...5.8.2i..,....U...R..\lJ-...t.XZY.H.5._.R.b5...ac.... ...S..LG...rn....gM....J.u71.p.:/J..E......lT.....F..!^V.f..l{.k......Z.....+)...<2b.....r...<bt...y. _/g....Y.......<'!.V<Dw.6...WQ..;..zm.y...Rk..Q..W9h.:.wLN@G.....B..o.....?j...#.v \.'....T.P....P...8M#6..r+...!.Wu.<!...L....LK.R0..,I0.....`...B.\$.s.).Dno...h....NanT...d.U_c..Zg..._.;H.8n:........=-.LQH.%.#.H:..z.)R~..A.5K5..z...I.9C..q-....---8+8*---403f5d9176fa91a26ae1988319e427037a04dc8c8847a94a86e9b3bc6ff67bbcd0de5b9cb84797c415bef23abc9f12d4e62d5d3b98487706c77d3581c8ca3e13a2f672f3acbb85f20efb95550448b2a9b45d58d6b6a25db915e63bd8666657e85c012664b0e225c10f68945f6e2bf167ef19c2757cedbac3c88f3b69652780a97cfc2f8894edb5b250dd5029c91dde1c1eeddb3cd1bf18119befd7c037bec2db71c1df4546e45da6ffd7853d0c3843defaf63ac16d2938d7c14279232e43d7a87fac3159157a884ae12ff59c1f6550cf683866062651df2e76c46b16fcc4ff08b18e54c0e9a0d

C:\Users\user\AppData\Local\Temp\2109793820.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.011656649177119
Encrypted:	false
SSDEEP:	48:oOST6ZR5ayHtGjsUjlSa2LDRl4Kh70Q1+IDGriQ:/bGjsUkHN70M+IDiiQ
MD5:	143C4584F49CAD4112013CD9C53C886D
SHA1:	9957B1FA11DA9B58E01AD30A84CF7FCACCBFBB1D
SHA-256:	11F3CC252F954C965A1391592135EDA43A268AA1BD022ED66DF9B6E60C5193B8
SHA-512:	E4D21FBD4C4A29E4D270FC3A2621E78C24E489BB8E6B3AD7D552DB95B0F02DEC754A2E5D2FD4537C82657EE362BDA5C07BE2A1E0F5EFC63124559FA7398567AA
Malicious:	false
Preview:	....zB7....O....!K%d.KZ`..8..-.`.........B...0......<Q.{<;...Q. .G..?....P"........7.5....gyF....@-.Q.E.J....uj....(..@.lU!.....Z...5&......ng......\.5......\|7.$.i..M[E...0....4....\|../,g\|d...=...cf..tS.Hh.u....?.i..2.=.Lg.UJ.P0..wi..N.b+9Nx..j...q....Da .d.o.....H?}...\<.^.l.Dl..,2..p=OzR.........<..6.W..(...M..6.F........Q=...G.O.h.h..dC0..jd......'.......7.K.....e.....r2.-^AxD.1....3..`.\U.]lEZ..:...q. ~.mki.U_8.y.4%T.UM..........-.....y....T..Qn.....G.n.9..T^e.C....p..z/fE1N!r.'...t.=..---8+8*---45c9ddee378493b1aa0b575f4311f5573b0acf37526ed75bf9ded159e2564dd9443fdcdd7518863b59e759250d03fe19ebc5a5573a662bc4d0fa2d45cf8b2148c582cb210a8f7f4004136a03495cccd0994b589d3c5e7b35d9969eef322085dcd6b7b84311321546a5f38c5aed35a1d445a4c9247b48dbec2a7ee8c8385b3cea40f10aff54bb301b8fcc3d4b8a388fb3471141728a0578afc4fb3e10896b0a38380f09490e8aca9aa1148d407d1db98dafa59d6bc10f7af45f366d08aad9547187df8f5b699262e631c690ccbe1c66d6113d17d2f8f0e817a60e278e6f8729e98dd56e58ca925

C:\Users\user\AppData\Local\Temp\2160417493.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.051668638183883
Encrypted:	false
SSDEEP:	48:oiWTMIojsUjlSa2LDRl4Kh70Q1+IDGriQ:TWwtjsUkHN70M+IDiiQ
MD5:	D06F862C118D06E1E8AEA96AAE12BCA4
SHA1:	8B2C473D906D96F6C26706378BB3C5E63184DA5E
SHA-256:	23E0B3586F5F682479D1FD0324C292662776CED7C58D525FF226A588B4381184
SHA-512:	41DAAC8095DBA83EB187FB0ADBDB5E1189091C5A437713278007ABCEAA56D9DBC0806019595076691E0BFC70B39EDD6141D023FB69292FF6FD41B9F6B611338F
Malicious:	false
Preview:	....zB7....O....2...PM....4.S.RV6g....)q../...Q...h${......a}....df.....qZ.)..v.#\..I...6....KAn...\...:w,O.8..b....F;soK.)~...5)@.7......oQ..B....r{.]p.5....S{.^.....Ls.39.s.\|((.&.DJ..2~..r.......l.F.e..Y.Q.8..S..).XR..p ...ks...L.NW.e.P...](.@G.1..pZ.Z.D...).}.....x.a Xelx..?......k......s.V.`..\......XE..>.:.@..]....q.....C.6......0....B1..U....-.h....D.......5...]..I....R!P.....[3.W.K..4N.)...j.>]$...........k8CT..C}..#.6V.P...Zy.8.h...g...;6..z.W.t.v.jG+..........F.....%.E....'...S_I.i.,..---8+8*---45c9ddee378493b1aa0b575f4311f5573b0acf37526ed75bf9ded159e2564dd9443fdcdd7518863b59e759250d03fe19ebc5a5573a662bc4d0fa2d45cf8b2148c582cb210a8f7f4004136a03495cccd0994b589d3c5e7b35d9969eef322085dcd6b7b84311321546a5f38c5aed35a1d445a4c9247b48dbec2a7ee8c8385b3cea40f10aff54bb301b8fcc3d4b8a388fb3471141728a0578afc4fb3e10896b0a38380f09490e8aca9aa1148d407d1db98dafa59d6bc10f7af45f366d08aad9547187df8f5b699262e631c690ccbe1c66d6113d17d2f8f0e817a60e278e6f8729e98dd56e58ca925

C:\Users\user\AppData\Local\Temp\2165547404.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.02079678522514
Encrypted:	false
SSDEEP:	48:TEXwuBhvarugh2yuuAFrkh3vkhRJ3v7VsC2jVrb:gXP7yrvhaxkh3vUv7Wb
MD5:	05A17675350E06D5E099838700DC4D0E
SHA1:	FD26A5AC6A5797E7F2596A98272864D8F9FEB0DE
SHA-256:	156742C5ADB85492C579C371F94DC01ABBDF201292FF7F5802F3EB43ACB45712
SHA-512:	80C96654FA2F80E7E43C6983AD57C7EDE26D6DC4F79559343955301BE47574859B5DC1ED0AE08761583D544B8D0FB21A09BD841F5F7BC60EA81334673DD15FFC
Malicious:	false
Preview:	...bm(lk]....3...f...?"T...Qj.S.B...&....=..._Gy-.2...@.f./`.........n\.....O.C%...f..-l'G....jw..$..$.k...L.1?.H.a........z>...7.@Sn>..N.o=.\|5.^.DhJH.....@..bO7.H.......t.?T.(}s-..\.:.\{...t..<.........._.:1}@{......o_..hq_.'...&....X.7s$.... ..!.j..n....s...7d..l...../:.......x.j.ZYr........H"M.2.h].Qw..<xQ0j...b.EF..d....D....;H....._Z.6.}.2.`...>.....g0BI...D..}........ ..j.qc.n..;6P.&....G.sg..Z.....4.J..s.15..#..=a?.2.W.,.S<..>..,..>..{..q...H..G.....`k1.........c.Q..tW..._..........e....\.aDj---8+8---7b6cd1bf575b8b6eeb85ebb5fbdac8ead6d3b99de6c0e59fdeaf1063b5bc973268de248d4d2cd5bd868b9a76048f23e1ff1f9eb9a06ea644ad4f5247f4117935f49637cab7a188ebbcae3e7d95584fcb9b50d88f553ef46805bca4f8c06574bce460a5dfaf4c0de94f2f68f23462370be3dc956dfa4963ba9df637446285a821b25613afe3ff5722682a7c881b42450fd587c3c55904718dd29ed40569be56a7aa68e38833cee680b925b3120f698a082aed27c33a2e9033f310b60d90f825b0eb3b9d31c6af203ba6135e69b3a4a6d83eda936aa3aadecdc8ef65369b5a19beb377f5d141652

C:\Users\user\AppData\Local\Temp\2265332024.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.041708295559391
Encrypted:	false
SSDEEP:	48:mcio6ZRW2pxJRuAFrkh3vkhRJ3v7VsC2jVrb:mnjHRxkh3vUv7Wb
MD5:	C264D52FA1D0C3D5F75B501CBC21E6D4
SHA1:	7A166F3B7002F40239D74DF8BB3F616AE37BF079
SHA-256:	16C25CDD75688D705F183578F8B338E596D1A2A1D396668D4DBA1680BF88A44D
SHA-512:	1FA6274EFC697D359F61C18BC408DF584F3C310C52F0BFA692859FC7D1D32AE36B025CB61EB9244277E3F5A4EE1B7F47304D92E6758BED6A447CC1C419402776
Malicious:	false
Preview:	...bm(lk]....3..........3Y....a...."..Ng.i..5^.:...e+.)../..6.h.E.....O.(.x.vo.V....@.}...Qm.Q...1...0.x".jr.{[.'...2.."...k ._.y7+M..i~..Zc.>._.....0..Q.`..........fc....O...`...,R..X.<g..n...."..7...O32-w.u.Y..^>..!8..TO.4B..Z%...Z!.p..}ST....R...8.Lj.....g.F..$Z..jN._.....]"..x.5y>V.X1.f....B....v/P.)..&..$..+Y.O...W.?..:...[eZ..![.....E7..P_.K....0.....aCl..y...e....~...<...J..B:G.(=.;q.T?)Ta\m.......3.....6..%..0:.Tc.........O.H'.!}.L.g..^..>.J.(.W..F...;.l....Ay....56d............L..----8+8*---7b6cd1bf575b8b6eeb85ebb5fbdac8ead6d3b99de6c0e59fdeaf1063b5bc973268de248d4d2cd5bd868b9a76048f23e1ff1f9eb9a06ea644ad4f5247f4117935f49637cab7a188ebbcae3e7d95584fcb9b50d88f553ef46805bca4f8c06574bce460a5dfaf4c0de94f2f68f23462370be3dc956dfa4963ba9df637446285a821b25613afe3ff5722682a7c881b42450fd587c3c55904718dd29ed40569be56a7aa68e38833cee680b925b3120f698a082aed27c33a2e9033f310b60d90f825b0eb3b9d31c6af203ba6135e69b3a4a6d83eda936aa3aadecdc8ef65369b5a19beb377f5d141652

C:\Users\user\AppData\Local\Temp\2265465471.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.020038821197418
Encrypted:	false
SSDEEP:	48:VJdoQxQJ/9mVuAFrkh3vkhRJ3v7VsC2jVrb:VsQmVIxkh3vUv7Wb
MD5:	DB751C376DE9AAB0682DD437B1B96891
SHA1:	186E693D9018ED4FE38A537AF2577A7C6544A0CD
SHA-256:	A7C833F10810678A4CA62A91045DFA15873BAF01977C096568A8C89B917FE974
SHA-512:	CFA911CE383EAECE60573F0959B9056D3F68DA37E9F20CAE753118BAF2F3033F180A1929BBD66B233711B74DDFC0741E9C7B6C805FAA22F95B0283E3BBA910F5
Malicious:	false
Preview:	...bm(lk]....3...6......r...8!.1..;.^.f}i.<Pg..t.GR..X.vfS...yg....\|.x+....$..%......K...{..Fc..(.M...X....Ot...b...J......Lp...P ....q..S.7.x.W......}..Le...>gq.n....\a....8.......L....B.g%Q.....)......W..WO...."..]^..b..(.'.+.4.f...r...{nF...q..c.g[;.G..h.8.i.lw.....U.T.3.d..T@.f2$sy.O......a".... .-..{I:O9.8}Bi..N..5./...J....b.(.....H.g...]}..bZ.}4.X.'(...kTo(.5..n=x.aj....<.[...Q8{....I.....(E..~k..D..A.....Yi~..A.w.z.$...[y[.6s.V.p........7.....0.m.xm.8YO.C.A]...S..h...../...j..E2d.Y.k---8+8---7b6cd1bf575b8b6eeb85ebb5fbdac8ead6d3b99de6c0e59fdeaf1063b5bc973268de248d4d2cd5bd868b9a76048f23e1ff1f9eb9a06ea644ad4f5247f4117935f49637cab7a188ebbcae3e7d95584fcb9b50d88f553ef46805bca4f8c06574bce460a5dfaf4c0de94f2f68f23462370be3dc956dfa4963ba9df637446285a821b25613afe3ff5722682a7c881b42450fd587c3c55904718dd29ed40569be56a7aa68e38833cee680b925b3120f698a082aed27c33a2e9033f310b60d90f825b0eb3b9d31c6af203ba6135e69b3a4a6d83eda936aa3aadecdc8ef65369b5a19beb377f5d141652

C:\Users\user\AppData\Local\Temp\2849925037.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.022650897730356
Encrypted:	false
SSDEEP:	24:8H61vE9clwc9XEgso1WDAFrr4ZTT3mkkhgSdZyAu0vI3yXEYVsC2jJE4vPrb:8aeq1R31uAFrkh3vkhRJ3v7VsC2jVrb
MD5:	0A7B6BCDC94A9E77C2D2C16F1B713C6D
SHA1:	DC77787BA053AADFC3C13345C6FC1CE7104D5301
SHA-256:	2C7D597068D9C641630EE388A37237F59E6296BE975D7EF64F1AE1254C614643
SHA-512:	DCD21565D7C2958089BF15E675F94A86EB1D27F26A9166955F37CC2D42F6EBCDB6889416BA6CCBAA9B9EDBD4427D45F06BE10F7E06DDD808436EC7CA55855F95
Malicious:	false
Preview:	...bm(lk]....3.....u@U.... :V.a..0d..n...I......(K.U...d!..yQ....<.`VO..d3R.I..j.D...UN..L..,s.w.p......{.u..&%..iR.....QZ.....t..Q...{i.6...c...~..J.X..CQ..u...F...0.3.s.......'f....{%..kk.,.\|..&..9...#..g..72.E.E2\....X.&5...j!....S....D..[....$."f....B.}.u....C.UK.#^...L.V?0m..mx.v.'....w.B.OY.@0z!."Btk)..u.`.0.6)-....Cv.z.^qh.....]g.e\|!w.....\.....8.!3....~.h. C.$.G?.w."O.n..s....&..pV.8,.kN,....V.X.hb.(.....Z....x..Ghl`J.:.)J.f.)L5% ...qY.l..?.M9..+-.]..,M.#AdH....{U.bK6.@.;w.....N..R.26..5..R.....---8+8---7b6cd1bf575b8b6eeb85ebb5fbdac8ead6d3b99de6c0e59fdeaf1063b5bc973268de248d4d2cd5bd868b9a76048f23e1ff1f9eb9a06ea644ad4f5247f4117935f49637cab7a188ebbcae3e7d95584fcb9b50d88f553ef46805bca4f8c06574bce460a5dfaf4c0de94f2f68f23462370be3dc956dfa4963ba9df637446285a821b25613afe3ff5722682a7c881b42450fd587c3c55904718dd29ed40569be56a7aa68e38833cee680b925b3120f698a082aed27c33a2e9033f310b60d90f825b0eb3b9d31c6af203ba6135e69b3a4a6d83eda936aa3aadecdc8ef65369b5a19beb377f5d141652

C:\Users\user\AppData\Local\Temp\2874006916.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.038944230449513
Encrypted:	false
SSDEEP:	24:HpQ8fbSB6bj8MewkPNvRRWDAFrr4ZTT3mkkhgSdZyAu0vI3yXEYVsC2jJE4vPrb:HBfbSByBquAFrkh3vkhRJ3v7VsC2jVrb
MD5:	DF855DBDD2E2C94E07321C728FF602E5
SHA1:	C0F3FC9D4B68A05ABE4EDC7A46AF95826313C758
SHA-256:	6CA4F3ADCED3D580AABC36BCEA2D6A7C8424262C1D0D4510E4A28187F2ECFD4E
SHA-512:	4F7082F8E9D41DBED5451A4EA85A4FCACBC7BD7BA575B21752CA2A702EEC4C025250BF11B767FAAD1A39FA90A60597B8DD862DBBCCE927AD092D347B8344791C
Malicious:	false
Preview:	...bm(lk]....3..../....... T.".ey..%...5....}7.>..h..S$.(....55P(.~....l....;..........z..F..4.O...m....UB...pd~....h..[J.:X.X..[.E.Fj.........4..=$F......"2..k........%..Wu`Q........f.7V2...<"...........<......r@...+Vk..y..~..4..Oe.....C..W.`.....d8W{.....t@:s......[.+.A....R'4,u..+._..1....LW.X....~G.....Z..,H.w.=.{..J...f...<.4.....PJ...~......z......V..................<.......<.J.9.m....d...:...{.e.F..._+......r].-....3.a4.I...........T{.....iir<P...._...Q..>.....7Z.}....r.v..k.A...---8+8*---7b6cd1bf575b8b6eeb85ebb5fbdac8ead6d3b99de6c0e59fdeaf1063b5bc973268de248d4d2cd5bd868b9a76048f23e1ff1f9eb9a06ea644ad4f5247f4117935f49637cab7a188ebbcae3e7d95584fcb9b50d88f553ef46805bca4f8c06574bce460a5dfaf4c0de94f2f68f23462370be3dc956dfa4963ba9df637446285a821b25613afe3ff5722682a7c881b42450fd587c3c55904718dd29ed40569be56a7aa68e38833cee680b925b3120f698a082aed27c33a2e9033f310b60d90f825b0eb3b9d31c6af203ba6135e69b3a4a6d83eda936aa3aadecdc8ef65369b5a19beb377f5d141652

C:\Users\user\AppData\Local\Temp\3013890265.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.029548407145844
Encrypted:	false
SSDEEP:	24:NMA2dniyCrYHZZWwWDAFrr4ZTT3mkkhgSdZyAu0vI3yXEYVsC2jJE4vPrb:Nj27nZPuAFrkh3vkhRJ3v7VsC2jVrb
MD5:	5AA17336DC411C7775F3F63781FCA649
SHA1:	F4F2CC63AE2B45647E4B0455F9C7AE9D6A6777E7
SHA-256:	A25003E8B40C8819EBC6526F154CD4880AAF31B2357C9E0F8C4F513DF92B7980
SHA-512:	3730E6EF00538464281B0E955184158D113DADA2047EF3C1C1052BF39E8A829A5F0E423BE35847A8A3492C5E3546DF1B838510D0E3785B6F5D88FB5080237B77
Malicious:	false
Preview:	...bm(lk]....3..@.i......2.._&..v.l%.uP.}V.....q..k......>....J..Md...4...n.u...E].pq..y.["1w9?su..v.w.........{m......._..9.....d](w..A....~}%.P.8.....#..0.O.a/O.DIC...X...B...q...J.R...9{...;.......&y.v....T..K......@.s9"..p.wD]F.....61z..s.M.D@..7......v........'.."zq.F..G.i....:k....q.....].1...E5xXQ....eT+.X&......H.!.N~F.j#\|e...9%....~0l...L.1.<./}(R(]GOw....p..'...".N72..Q\|..zO....C......E.../b...X...E?VQ...{]...Xy.v.X..).y1..(~P.]...\.."....o.v..f3.(6"..L.c.....\|r?\|.O.x......C.!.@...'.l$---8+8---7b6cd1bf575b8b6eeb85ebb5fbdac8ead6d3b99de6c0e59fdeaf1063b5bc973268de248d4d2cd5bd868b9a76048f23e1ff1f9eb9a06ea644ad4f5247f4117935f49637cab7a188ebbcae3e7d95584fcb9b50d88f553ef46805bca4f8c06574bce460a5dfaf4c0de94f2f68f23462370be3dc956dfa4963ba9df637446285a821b25613afe3ff5722682a7c881b42450fd587c3c55904718dd29ed40569be56a7aa68e38833cee680b925b3120f698a082aed27c33a2e9033f310b60d90f825b0eb3b9d31c6af203ba6135e69b3a4a6d83eda936aa3aadecdc8ef65369b5a19beb377f5d141652

C:\Users\user\AppData\Local\Temp\3024948866.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.000149951454298
Encrypted:	false
SSDEEP:	48:YOYGGpgDCoPHFuAFrkh3vkhRJ3v7VsC2jVrb:1YGzlHFxkh3vUv7Wb
MD5:	E93ED0F86CDF086673128B64666E9ADD
SHA1:	EDF0C8A48DF5928EF2760E6645630402E927C581
SHA-256:	2520B46A83614C4F590B1CA58431057D7ECF8E8E1C8F614566100A681C91AFF3
SHA-512:	82F0FB9D3C2ADEDAAF1388AF5C7173589A03A71B9D2371D5EF1816C1C0453FE1C3A9EAE51680B412E316D995BD8C51B55196DCC83E771F3FBF6346C5AD0C4D7B
Malicious:	false
Preview:	...bm(lk]....3...o..%T.,+.t.2.....m?5...J.L.6..q.v...p.. >.....__L.@.U.^. -.VxI?-.{d........H+%..T-......f$.....e.0`.....[..!..a...z..m6..cP\|15....`0mB_h..4 ..t.......e..B^.R.I%.%-..Le.LF.w.N...ZZ........Y.......}.1..w..o..q....An.3gX....&T..A.O.C.......6...u......I...D.z\.bK.N..E.@0.x.....J..5A03.&;3 ......!....{...........".. x..p..X....>.8.">..5.O2..fhc..u.........q..0:....{.8.Y9C..T\BN.%..... k5....+...p..n......!^m..:....[w...1...(e#..&...........D......S.?i....$<J..W.%.D...>j..uc.G...w..---8+8*---7b6cd1bf575b8b6eeb85ebb5fbdac8ead6d3b99de6c0e59fdeaf1063b5bc973268de248d4d2cd5bd868b9a76048f23e1ff1f9eb9a06ea644ad4f5247f4117935f49637cab7a188ebbcae3e7d95584fcb9b50d88f553ef46805bca4f8c06574bce460a5dfaf4c0de94f2f68f23462370be3dc956dfa4963ba9df637446285a821b25613afe3ff5722682a7c881b42450fd587c3c55904718dd29ed40569be56a7aa68e38833cee680b925b3120f698a082aed27c33a2e9033f310b60d90f825b0eb3b9d31c6af203ba6135e69b3a4a6d83eda936aa3aadecdc8ef65369b5a19beb377f5d141652

C:\Users\user\AppData\Local\Temp\3050907755.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.02393272158325
Encrypted:	false
SSDEEP:	48:Y9EdSJL/LEJnWoVOLuAFrkh3vkhRJ3v7VsC2jVrb:eEvNIxkh3vUv7Wb
MD5:	578F62F46E61984C002706666B29A4A0
SHA1:	815A4CA42ED7976A6578E88C8201A4C56A625319
SHA-256:	6C56FC3CE8C04B6E5DDDB8A119B9B5707094DCE90A6603BA6CA62B09B0CA2A3A
SHA-512:	58003DA0815D743AEA40F5C61DE845AC2B3B51BA1984F57DE46CDC7A97EDF878094085EE6285526FFD840242EB2F1A1D5F64FB525045642F85EBDB0C47798A36
Malicious:	false
Preview:	...bm(lk]....3..&....m.Lp.....(I.x.v.`."....0&V\|..._.....[....q+..{p:....&A.K....k...Q.._...>.xb../.by.,.....P)._F...O4Qn.].... ...DO.V..".OA...59.t.i>.Y.....-.= +..j..r.Y..P'.E.E.c.. .>j.+....G\h.7c....>..!.c.z....}t0...... .zX4.gT28...?..Eq.. ...S`..W..X.[..h.@..d.KV..@..nd.c.7u..F..6E.A...S.t.~.....6...........,rac...G._l.e.L..E...fG?.R.mW...XE3........O.b...i.{...B.@(.2..l.9n..v. ...y.....X....v.......)....iy..f4...b.....j.m6e..G...+...k....]Q........L....$e.,.q..L..\|...\z......&---8+8*---7b6cd1bf575b8b6eeb85ebb5fbdac8ead6d3b99de6c0e59fdeaf1063b5bc973268de248d4d2cd5bd868b9a76048f23e1ff1f9eb9a06ea644ad4f5247f4117935f49637cab7a188ebbcae3e7d95584fcb9b50d88f553ef46805bca4f8c06574bce460a5dfaf4c0de94f2f68f23462370be3dc956dfa4963ba9df637446285a821b25613afe3ff5722682a7c881b42450fd587c3c55904718dd29ed40569be56a7aa68e38833cee680b925b3120f698a082aed27c33a2e9033f310b60d90f825b0eb3b9d31c6af203ba6135e69b3a4a6d83eda936aa3aadecdc8ef65369b5a19beb377f5d141652

C:\Users\user\AppData\Local\Temp\3209467860.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.05782835588768
Encrypted:	false
SSDEEP:	24:y8R+U23KnZQLWDAFrr4ZTT3mkkhgSdZyAu0vI3yXEYVsC2jJE4vPrb:y8uKZIuAFrkh3vkhRJ3v7VsC2jVrb
MD5:	739863EDD17FE12EF6F43EDAF3B69137
SHA1:	4599482A71DF34BDD51748313E9DD90F04321887
SHA-256:	0B2B4BBDCFACDC052CD6C1D4AB387E7ACBBB8A66F3FF5D056EC42ED25F2B245F
SHA-512:	8B9F86C3E1238253B067841B8BCE899D7E819ABB1DBC4B880C1D43B7060AD031BA105E385365024360065A763C081C69B6EDA13A790408C83DA6A38E146265FB
Malicious:	false
Preview:	...bm(lk]....3..]....4.;ob.L.F..V.......i...>..>z.Q.k.......j!..m././...t..Fk[.X\|.%}..L%...b.LMa.?.'R...p.)...H......6.kg...!.u...U........'/g..W.\|WW.pF.~...p...P..".q..3qq...)..K....\|\.].U..Z9.(.K....L.4Mn...3..\;..jS...9@.......F".tj..5.h.\i.R.j.l.........r...r......sd8_.].Q.".e'V.T'.....R.u..W.L.B.fHEH8n...O.w...s....P.......P..(..$..=N'.1P{..... K........G.C....7(........%.%.'.U.. ..fe+....O}...X....v.p}.4"C..$'.;.....]O.E1.t...Kw.X.;.....Z....[U...P.V.c.ye?B.O.R.&`..,T,L....Gfk.Y)..)x...b---8+8---7b6cd1bf575b8b6eeb85ebb5fbdac8ead6d3b99de6c0e59fdeaf1063b5bc973268de248d4d2cd5bd868b9a76048f23e1ff1f9eb9a06ea644ad4f5247f4117935f49637cab7a188ebbcae3e7d95584fcb9b50d88f553ef46805bca4f8c06574bce460a5dfaf4c0de94f2f68f23462370be3dc956dfa4963ba9df637446285a821b25613afe3ff5722682a7c881b42450fd587c3c55904718dd29ed40569be56a7aa68e38833cee680b925b3120f698a082aed27c33a2e9033f310b60d90f825b0eb3b9d31c6af203ba6135e69b3a4a6d83eda936aa3aadecdc8ef65369b5a19beb377f5d141652

C:\Users\user\AppData\Local\Temp\3580751004.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.035442609364592
Encrypted:	false
SSDEEP:	48:ZbDFMW8ddbuAFrkh3vkhRJ3v7VsC2jVrb:ZHIbxkh3vUv7Wb
MD5:	AB000D6FC3F9FADFE91141C0111CAEEB
SHA1:	C7F93E5FDCB71F559658B39D54CEAC5ACC1556C7
SHA-256:	7E388E4668FC3B0D24D7A3163E2DF0E89F4D729771FE6D815E6FDDFA99110EC3
SHA-512:	48BA9A1631729318A3513A9560A932AAF9AA21EF5A8D98111782731A7C73250D96A598469F81DF3BFE7DA07B25A9E27251865E29684607A45221C6FCFE0EB62E
Malicious:	false
Preview:	...bm(lk]....3..Y..O...)..X...0&..-t.._.yf.....j...?o..K...].V..W......U..}U..#...d.R3..p....g..es.l.v..R{d...M.>T.@....f9.L".7.A.D...t.U.k.......=.o.x_....St'%...,{..DF\1...5.E..O......CaO....\|.p.4...s....RX,...k4...s.ub,.<^%).s.dVw&/\..f........R..B.q.E..........c........LN.).......P.S..:.(..[.N.9m..@t...=...+p6.c>Y........t...z.q.uZ..T.....'.}..m.....(c.../..e.:.v.t...z......?...G.`..y2.6...m....6...'..U..jU^.....b..{...p.?.e^]v..+9........9.K..g.l..)\=H..]T..muy.Y..`4.Y;M..\.........i---8+8*---7b6cd1bf575b8b6eeb85ebb5fbdac8ead6d3b99de6c0e59fdeaf1063b5bc973268de248d4d2cd5bd868b9a76048f23e1ff1f9eb9a06ea644ad4f5247f4117935f49637cab7a188ebbcae3e7d95584fcb9b50d88f553ef46805bca4f8c06574bce460a5dfaf4c0de94f2f68f23462370be3dc956dfa4963ba9df637446285a821b25613afe3ff5722682a7c881b42450fd587c3c55904718dd29ed40569be56a7aa68e38833cee680b925b3120f698a082aed27c33a2e9033f310b60d90f825b0eb3b9d31c6af203ba6135e69b3a4a6d83eda936aa3aadecdc8ef65369b5a19beb377f5d141652

C:\Users\user\AppData\Local\Temp\3677062445.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.037692877677689
Encrypted:	false
SSDEEP:	48:sfey6+KcGrM6aRuAFrkh3vkhRJ3v7VsC2jVrb:s36+KcG4xkh3vUv7Wb
MD5:	8050288A2B3B1D4F3048C394EA76FE71
SHA1:	A2574B5C0CF703B35EABDFE3E64BB4FA48EB42E9
SHA-256:	8499A4B0CE3FCE9A2B274EF6D107C4D9F4260AF39B27D4A64E40565DC5EA3511
SHA-512:	8698579940145E70B3542867F20DD61360ACDD12ED5577E2679877DD52DB8BA65BDB167EFFD8788E5306B30B2B6D17CBBE7806E4C70EE750BC4E0D5C0379D905
Malicious:	false
Preview:	...bm(lk]....3......6r....<0.s..`....,.`.b.4...>[..S.^.G....$ DU#.D..w,E.....A.0Ph.y.U......!.Y\|2.\I.s..E....\..v..}R.n.$.H..8...$..zQ/.v.lU....`w~K.%.1.j.P"K.....'....j..\\|..C..N.pQ..G.(<...:.Z(....Z..wA......7D.;....N..l.y...U..r. 1.S8h#..5C..o..E5.....T^Hx....\|.......tR..D.dB.6.C..RtC...B..#.Q..fKJ;%.];.".q19......^B..;.l..u...".+./.'.K.Q.......j..2!.N..[.!}..Zt.zM..e..K.#o.v.(.F9.&.....2.bq&6.k.....+.8.:.n...+?.6.!f.l.:..3.N.-..z:.O:......]L..#..~.:.dE.~........?}..G..;..]...6..4.=2u...F.G..!.---8+8*---7b6cd1bf575b8b6eeb85ebb5fbdac8ead6d3b99de6c0e59fdeaf1063b5bc973268de248d4d2cd5bd868b9a76048f23e1ff1f9eb9a06ea644ad4f5247f4117935f49637cab7a188ebbcae3e7d95584fcb9b50d88f553ef46805bca4f8c06574bce460a5dfaf4c0de94f2f68f23462370be3dc956dfa4963ba9df637446285a821b25613afe3ff5722682a7c881b42450fd587c3c55904718dd29ed40569be56a7aa68e38833cee680b925b3120f698a082aed27c33a2e9033f310b60d90f825b0eb3b9d31c6af203ba6135e69b3a4a6d83eda936aa3aadecdc8ef65369b5a19beb377f5d141652

C:\Users\user\AppData\Local\Temp\3746535660.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.000616983270504
Encrypted:	false
SSDEEP:	48:fogr/vHrk76aVZuAFrkh3vkhRJ3v7VsC2jVrb:h/Pr3AZxkh3vUv7Wb
MD5:	63C1065EF40099FF33C743C656FFA38F
SHA1:	851D7520A85DE57C698C674536D3C46BDBF59114
SHA-256:	DC783D333ED31C3791A61D8B6E26DFC408F2766C79D431D4C8263B97B901EC75
SHA-512:	8B28B16F481C8FDFA2A05B80DA7C089E00E58D00B54D90B1A79ABF6D4EC6DE8F9D20C21B1F96A9B1929E8C5AC2B9C7DB44D076D102217A1C9ADE3934C516925A
Malicious:	false
Preview:	...bm(lk]....3..9..l.s.~.9...b.l{bHI2iu..`M..'.Bb..Y....c..9.s.`{.;.......t......_o.1..pL.z\|N6.5....+....PJ-.`.,c.M.x..j.[.P!.u2... PM..f'!.m.C.E.^.d@8.^1......hL..8.b..o.D.jZ.e0N..D(..R...m>..b..1-...a.{n!^..p...m..TP...bh....].5[I.+.M..<...m.E..U......~?..I..X.......XC..Q....(..5:.{Y)......>6......i.-".$..w.".J.t..%...,l.....!._.......8....8.,..\|#......./.3y.Gv.....f........w...f.[.g..g..z2U.y\...4S#..S..........R.'T....b.BS.2f. >....h..c..a,.......J.......P..[.4.Vy$..\|....b.u.....m..O.^ygCel---8+8*---7b6cd1bf575b8b6eeb85ebb5fbdac8ead6d3b99de6c0e59fdeaf1063b5bc973268de248d4d2cd5bd868b9a76048f23e1ff1f9eb9a06ea644ad4f5247f4117935f49637cab7a188ebbcae3e7d95584fcb9b50d88f553ef46805bca4f8c06574bce460a5dfaf4c0de94f2f68f23462370be3dc956dfa4963ba9df637446285a821b25613afe3ff5722682a7c881b42450fd587c3c55904718dd29ed40569be56a7aa68e38833cee680b925b3120f698a082aed27c33a2e9033f310b60d90f825b0eb3b9d31c6af203ba6135e69b3a4a6d83eda936aa3aadecdc8ef65369b5a19beb377f5d141652

C:\Users\user\AppData\Local\Temp\3764832265.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.072854273454508
Encrypted:	false
SSDEEP:	48:FX+jogiP5/B5uAFrkh3vkhRJ3v7VsC2jVrb:FX+jogitbxkh3vUv7Wb
MD5:	AF121767B0758326E1901268DCBCD9EE
SHA1:	4174E236E0624720E03A04CEB8A10C113AA91483
SHA-256:	21C88065C98799A1890E8E2BF646C16406C770233212E94BFA681ABBD1325EE8
SHA-512:	E8EBF9AFCC61BF6D9C3BF7C8DFD4043888AE68E11FCAA222AFB80ED8C69E87F7C0E0134F7A0FC3181CE93F90BA8327C8CD06CE391CA60C4888D73B0C68EDAC0C
Malicious:	false
Preview:	...bm(lk]....3...2.hR.6R.!.....SRxVs.(...2.<...\|...`.-...y....7...FdDJ...Q.&....]}R..{Q..P....;/Iw.j..M..;.T.....'.:._.\|Y.'...K.I......k.q..V...v.......Ln....)K..R6$k....rk.....R..Xd....A.l8M....U.S6I..s..A..."&..{....K.\"m....4...].;.....-...uHvcp...u..,....t..1... @.....,s.u.O4.h...C......%.o....8.X.........$p..W..3...@s....M.f... ...+..w.jt.A8@.L........^.a..D...@E...Y.....B<.....r.0.?.n.Z....."S..6.M.'.p.J.....\|.O_:.K..........S...\|...Z..c..^..%...tt..Ou.....t!.C.8o..@w>..R>LK.).1U(...e.---8+8---7b6cd1bf575b8b6eeb85ebb5fbdac8ead6d3b99de6c0e59fdeaf1063b5bc973268de248d4d2cd5bd868b9a76048f23e1ff1f9eb9a06ea644ad4f5247f4117935f49637cab7a188ebbcae3e7d95584fcb9b50d88f553ef46805bca4f8c06574bce460a5dfaf4c0de94f2f68f23462370be3dc956dfa4963ba9df637446285a821b25613afe3ff5722682a7c881b42450fd587c3c55904718dd29ed40569be56a7aa68e38833cee680b925b3120f698a082aed27c33a2e9033f310b60d90f825b0eb3b9d31c6af203ba6135e69b3a4a6d83eda936aa3aadecdc8ef65369b5a19beb377f5d141652

C:\Users\user\AppData\Local\Temp\3771420242.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.03116531040471
Encrypted:	false
SSDEEP:	24:MXV+tUXFf3PSj1uJqaWDAFrr4ZTT3mkkhgSdZyAu0vI3yXEYVsC2jJE4vPrb:00U3MzauAFrkh3vkhRJ3v7VsC2jVrb
MD5:	1C0222C13CA7C79372B9EA48DD3BEBAF
SHA1:	8400F51DD3F24711EE348DFF69EFF2F65DB67BF1
SHA-256:	EC36A7FBBE79278DBD5472FE73515FB2A7F2A8AB9B95DCB5918FCB6BA4469CD7
SHA-512:	F510D4A016ADC9DA65B3A1DA5496F38581D956835E93109B6F0E3275D9E2A4EB5710F12E3040E5B583CEBA66C6FFA3362B63365F0993B320488ADEB700CE4535
Malicious:	false
Preview:	...bm(lk]....3...M..U.].....?0.M...i......8..f,.......}{9....mK.&..!......#..?.Ebyv.0.....1N....Pp.rO..'\f:....W..x}..>=.2.D4i..Y..].....gD...8.......Ac..E.$'.......j6.q....$.'..9/....vHK..kP....~6..hi9...E>U.lz.q$.:Q..X6.:.(... ..v\..7J;O0..$rZ...nL^.2:wA........9./c1.l^........OM/@;.xV..x...P..Z$..2..Wb..#.>. .........Y.mu\|p.B....C..9.u...!..RH}....~Y.+.+.RC.qw.....7X.j.".Z#...V...I-2.T.c....6.hP.....=.h-F...]..%...a...m.Y.....=....?0Cy....j....L......\|.....@....~....P..vY.....?h..q...u.q.UC---8+8---7b6cd1bf575b8b6eeb85ebb5fbdac8ead6d3b99de6c0e59fdeaf1063b5bc973268de248d4d2cd5bd868b9a76048f23e1ff1f9eb9a06ea644ad4f5247f4117935f49637cab7a188ebbcae3e7d95584fcb9b50d88f553ef46805bca4f8c06574bce460a5dfaf4c0de94f2f68f23462370be3dc956dfa4963ba9df637446285a821b25613afe3ff5722682a7c881b42450fd587c3c55904718dd29ed40569be56a7aa68e38833cee680b925b3120f698a082aed27c33a2e9033f310b60d90f825b0eb3b9d31c6af203ba6135e69b3a4a6d83eda936aa3aadecdc8ef65369b5a19beb377f5d141652

C:\Users\user\AppData\Local\Temp\3901201620.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.035503523996227
Encrypted:	false
SSDEEP:	48:Ohoqh0qAmlzLouAFrkh3vkhRJ3v7VsC2jVrb:OhFhhXlHoxkh3vUv7Wb
MD5:	9E1AFBCB04C566CFECEA036EEA122BBD
SHA1:	AA12845103180401CEFC2FE601FE7BCBA6D1E3EE
SHA-256:	0D6EC6E4E72F2380B48F85A74FE743E646733BCB6CCC0EFE96FCDF8517A8AB1E
SHA-512:	ABEBB7582C329881B79060BA1FC0DC6A375BBB82A1C9CD1C4BEEC8CCDAAD5147A6C3BA703B76EDB84591BB51838DA7BA85FC2AC4FB2A9D9767CB1CD68095A303
Malicious:	false
Preview:	...bm(lk]....3.......&.i:.....p.x....U..w0E.t......1..H..6>}.%.$..O9.~..FLc....[. ... {.0.'.(.....A..s...3.....l..d.#I.'0..I.SVt&.>Y7Y..T..........qH...K+[.2@.h..2....m..YS.B=....r6.B.^j..Z..;y..$.p.D.7...q.o. ..!..!.M.......R.L1..Y.\|g.J.....qP..th....C....a2....f.s._H3.V.C../..[...w.sh.....VY.o..-.Y.A.Q..M.3.5.......CY...Ou.A....!.a.........3Q....{..i.s:..[..qy.....gzph.4y..o.v\|3.d.U$..%..=D.%..$.g...."#F}...W...../B.a.;\|.E.5...r..GC.x\.E.%.+..#..^.oe.mp..........$.!]......0<z...)C....N..cdh---8+8*---7b6cd1bf575b8b6eeb85ebb5fbdac8ead6d3b99de6c0e59fdeaf1063b5bc973268de248d4d2cd5bd868b9a76048f23e1ff1f9eb9a06ea644ad4f5247f4117935f49637cab7a188ebbcae3e7d95584fcb9b50d88f553ef46805bca4f8c06574bce460a5dfaf4c0de94f2f68f23462370be3dc956dfa4963ba9df637446285a821b25613afe3ff5722682a7c881b42450fd587c3c55904718dd29ed40569be56a7aa68e38833cee680b925b3120f698a082aed27c33a2e9033f310b60d90f825b0eb3b9d31c6af203ba6135e69b3a4a6d83eda936aa3aadecdc8ef65369b5a19beb377f5d141652

C:\Users\user\AppData\Local\Temp\4054640694.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.012290271206913
Encrypted:	false
SSDEEP:	48:ySOy0jGZhWjLr//fiz0IkrW4W1VKTRzYWwfiiU4zN:8vjaUf3fi4IkW1V5XJzN
MD5:	60BB618D33F9DEFC17AA44DE5BBADCAE
SHA1:	49CA86F94F1B61670872476CDEEAD4C258CDD18D
SHA-256:	9EAAAFFF433F43E3A08B4A848D0132F1EE650F42BBC253AEB5D1E8D2C80EC2DA
SHA-512:	C7FDD355B8648A5E1101A2690A12B3BF6743638920F9C85534C43F6515F131485362D8973D3D0D336E0B46355807258A38986C7B1F65BD889F1CCD816808CF0E
Malicious:	false
Preview:	.......6..M..!...M.6./i..tX.T...F._........GF~..../N.[j......X.X..\....ID.W=.3....x.3..\._Q..E..L.K...me.R.<........z..i...fV...fw..O.....D..}a..+.~.....[\|.b....V<..M..G.\....!...X\|s........x.W.....^w..U....QiNXo#"0.rZY.y.A..H..(q.....v.Cml..~8j..k88.b..@...p.....9<.3.....7......>i..W.].....e......:h....c.....(..+^`.D52..0.h4...f...Kj..l@..{......8.mhx.d......T.!^.....[I..X..3.....?..d.U.......xf~(zF...[........C...d.~.!...t...kd..Q..Da.cQt.!......!=.4.....W..l=....t.aibt..ZLz.u..XH..Q.y...W....---8+8*---50c4345d433c1c39e2e00a706874993b93357cac5cc15575579bb1fad6aa55f877ea078e44e0ea584e2af50b355d282747c88fe97bb33d653d3cc544fe4d3ab8dd214bc66d41404b134a8b718b3b434093472a7b0f50a616e16414dc5c7e23ec720991997b554a9504ff4e7cff16b0bc4703613eac0769d6ca020945fc4222ce43a17e1e43836d30e06b982112a4b10dd36da78e894e5dc263cd312510cda6837cdc85aae3b028e49007c8f1274905009bece7e26e4382ab4653e9f31273abcdf2fd1ba04318439630357b40620565503ae83699e0b685d83bc7f340e24477c4a07c5b20061fa

C:\Users\user\AppData\Local\Temp\4144085054.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.031462001527615
Encrypted:	false
SSDEEP:	48:sZKsL1JkrL/yYkMmQViz0IkrW4W1VKTRzYWwfiiU4zN:UKsL1Juy5QVi4IkW1V5XJzN
MD5:	6E7E1C52499DC1D32F27788B91B1267D
SHA1:	6534F964F23A180EDEAF8BFA47826654EBEB3BE0
SHA-256:	8E42A9AD9AE8C82C31A8B0C9EB764FDB920CFF20B8DF285CFF603B64A0026744
SHA-512:	B7CD06C607AD75E1BD8F04EFB9EA1B9725A5C894BB99F1D596836B3D8DC1B31995DA9ABE481E24FFE1C0CE7BF976BE4383C7F13993A1A789D0CBADE016652166
Malicious:	false
Preview:	.......6..M.E...#M..H,......Q..C.1.."....dN.`........%...EK....g...!._.k..^...?T.....q..v...T...'.`a.t.....=.....i.)wgZy$.f..^h..e..7N."...."Y..'......$/)..).a.f.M.....z_.........)Ko..g.:e.s..;...j).7.0C.n...}.7...7..;_....P9.2.E...U..4y......CQ..JoI........._.".....R...tiJ.$.P.XF..i..t.fi..vY.PS.p#.i..(..p.:.8..Cz.S..{.z..2[}{.<v..I.....?Cr..K.z.~.?.@KK.K8~..z<.".:...p -.. .c...(.n.c...h.(\|...\|.c!..d.&G.v/z]....E~..b0...2.sd....zd.HB,..K....}.....G.........z....../.\.H.2........&&; .m+x---8+8---50c4345d433c1c39e2e00a706874993b93357cac5cc15575579bb1fad6aa55f877ea078e44e0ea584e2af50b355d282747c88fe97bb33d653d3cc544fe4d3ab8dd214bc66d41404b134a8b718b3b434093472a7b0f50a616e16414dc5c7e23ec720991997b554a9504ff4e7cff16b0bc4703613eac0769d6ca020945fc4222ce43a17e1e43836d30e06b982112a4b10dd36da78e894e5dc263cd312510cda6837cdc85aae3b028e49007c8f1274905009bece7e26e4382ab4653e9f31273abcdf2fd1ba04318439630357b40620565503ae83699e0b685d83bc7f340e24477c4a07c5b20061fa

C:\Users\user\AppData\Local\Temp\4458179343.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.056166784658016
Encrypted:	false
SSDEEP:	48:dtIqLwFJnfiz0IkrW4W1VKTRzYWwfiiU4zN:c0wFJnfi4IkW1V5XJzN
MD5:	9F303BC0F78A880BBA4B30292D113A17
SHA1:	46822E5A01EE68CF1177121C46D859C41B9F6991
SHA-256:	333E5C4A4E7682222EAC998FB35D7A529956ED422A4B066818EC5F9207E008DB
SHA-512:	16EE7E6B4E0CE3A6B94FC17F1AACE1F3B0D7CBE63C63140A772FAF03C44658AB2A55FFC75D9773DCF7A48E023554CF667816E6A518B82B326782948F6542DB5F
Malicious:	false
Preview:	.......6..M.z...,rjA.b.."...l........Y.IX..Y..\|..L@..24..;.R.........q\.B..-/.n.z..F....{e..t.Q1-_&..F.9\|Gr...K.A>....C.W+.R.}...y.m ...0%..Rg.8...y.........^>..SLU.Z%...{$T..@....;,M5...+5<r.....\|...P....Q......N.<.....Ag.sx.....uo.U...$]......j.y.4.jF..,.^..^..hPu'>.9.6.....>F!1.5...g...KIbh{.gp[c1..1..\.r.6....G..q.j....<.....X.:v..Rd.,..0..lV.].[...9..\.4HlG.!.0+..)WQ...8.4....K.0..N..t.tV..qUn...Y....JZ..P/..k>w........u(.X...?.....z...E........0.~.U]...h)yoi......d...`....v.(.....\|.---8+8---50c4345d433c1c39e2e00a706874993b93357cac5cc15575579bb1fad6aa55f877ea078e44e0ea584e2af50b355d282747c88fe97bb33d653d3cc544fe4d3ab8dd214bc66d41404b134a8b718b3b434093472a7b0f50a616e16414dc5c7e23ec720991997b554a9504ff4e7cff16b0bc4703613eac0769d6ca020945fc4222ce43a17e1e43836d30e06b982112a4b10dd36da78e894e5dc263cd312510cda6837cdc85aae3b028e49007c8f1274905009bece7e26e4382ab4653e9f31273abcdf2fd1ba04318439630357b40620565503ae83699e0b685d83bc7f340e24477c4a07c5b20061fa

C:\Users\user\AppData\Local\Temp\4683256203.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	5.990471514738739
Encrypted:	false
SSDEEP:	48:HJ/wvPXxT7cyiz0IkrW4W1VKTRzYWwfiiU4zN:p/wnxT7cyi4IkW1V5XJzN
MD5:	EAE71321D672BDA97854D6C2BA538192
SHA1:	20118C7D5D0839D7710762BFF18FEBB7C39BCCBC
SHA-256:	C51F60AE0E7B1CFA505E99059E6454B93931482C905CBACD6A4F6F34D9D1C6A9
SHA-512:	211C46C2CBFE124EC2A10D38C116607323EDCE5FB35CC9DB0AE6FCF8EBCC1DC7C037FDD61A7FCD9A2DD12ACAF2774751190870F10C4CC2B188192CC25E87E61F
Malicious:	false
Preview:	.......6..M.....mk.......uj...z..2.#.....&A1UD....]...!#e,.....@............ ..r.<....j0}A.`0.2...{..G(h..=....u..........Y...}.9..lZ]..K.=z...fk.\R{...,..'...;..(..r...J..})g7....w...jo..N...%5...~.0..i...a..'5.t....B8..0U!.1.......2..P.fV.....{..5..R.].d..s..g..\.p..........ED!.; 9......e?=r...M3.u....T.>4e...b.....\......0}@7Y.Y..#z.w..`..q....d ..%.......\.!..]...^.2...g..K.\|...3Y........H....9..j.?.sr..\].~.NR....9........8..4......l.T..G1;.(.......~c8v.<;...2.+.Z.r.c.O.....---8+8*---50c4345d433c1c39e2e00a706874993b93357cac5cc15575579bb1fad6aa55f877ea078e44e0ea584e2af50b355d282747c88fe97bb33d653d3cc544fe4d3ab8dd214bc66d41404b134a8b718b3b434093472a7b0f50a616e16414dc5c7e23ec720991997b554a9504ff4e7cff16b0bc4703613eac0769d6ca020945fc4222ce43a17e1e43836d30e06b982112a4b10dd36da78e894e5dc263cd312510cda6837cdc85aae3b028e49007c8f1274905009bece7e26e4382ab4653e9f31273abcdf2fd1ba04318439630357b40620565503ae83699e0b685d83bc7f340e24477c4a07c5b20061fa

C:\Users\user\AppData\Local\Temp\4728479984.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	5.998292477887245
Encrypted:	false
SSDEEP:	48:Rj/nSqUQiz0IkrW4W1VKTRzYWwfiiU4zN:Rj/zFi4IkW1V5XJzN
MD5:	9BEF3BE11F535249EF5B244DC8A8FB63
SHA1:	362E0855F3815E0AC18E5E63780186DA882C930E
SHA-256:	7D012955D98FC73D83F3DFCE7B8F9EDF069D260830DEEFAF72070B1D1CAA01A6
SHA-512:	BAF9D83CB0F448105CA7FE2F048D82B12DF61C3900A145D2EBB352986013EA9C1851EB4FEA5B4E31A1E14420565D881DA0B208467360D728D261D32CA802648B
Malicious:	false
Preview:	.......6..M...g...[.,..J...Z..;.Zu.G.s.y..%.3O.zJ`..(p\|.BS...r?B....U..i...U8....M.c.\..zh3.....X.H. .XN.k...D..,".5@\|NI..RhHL.Bcc...":.\..... ]...9.%ty..E.<..x.u.....5b..M.H...@..L3...../.4.4.\v.4.I.@).....ld".3...2!.~Y..8.(.+.1.0}.4.X]......;\|x.l.AQm..b..H.....B....."..{.W.g.Gv.}..O\|EX.S&...e..'...^.4.8..!.....O.mt..7}p.=..B/`....NS0..=..2......."H.?2]d..H7=....y..l..Q...-....p...K\|.$C<~9...x_~.-X....!dd..p..p.L:"t.~;r'P..;y6.'..R.xy.x@..^.!..6.a6.-...z.<...}h...-L...{,...e.C+.:.Jg&2?.C.BAX.---8+8---50c4345d433c1c39e2e00a706874993b93357cac5cc15575579bb1fad6aa55f877ea078e44e0ea584e2af50b355d282747c88fe97bb33d653d3cc544fe4d3ab8dd214bc66d41404b134a8b718b3b434093472a7b0f50a616e16414dc5c7e23ec720991997b554a9504ff4e7cff16b0bc4703613eac0769d6ca020945fc4222ce43a17e1e43836d30e06b982112a4b10dd36da78e894e5dc263cd312510cda6837cdc85aae3b028e49007c8f1274905009bece7e26e4382ab4653e9f31273abcdf2fd1ba04318439630357b40620565503ae83699e0b685d83bc7f340e24477c4a07c5b20061fa

C:\Users\user\AppData\Local\Temp\4941266003.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.0653796430933955
Encrypted:	false
SSDEEP:	48:oIANZCC0xSiz0IkrW4W1VKTRzYWwfiiU4zN:T4L0Si4IkW1V5XJzN
MD5:	0CD53731677A5726ABE45B90945BE736
SHA1:	5AE63310D228825269DC8D63CCC769A8D3F75760
SHA-256:	3266958388353E25CD9E7A143272968DE80A6529D4BD992ADF6E3B9928B48959
SHA-512:	3F3A6925E45E29646B314B91FD8316829995DC559F2CB78C25FB5BA0875DAC94995934E6B6ABC95AF4346462D423AD261EFC38541B4D9833951244AAD5610D10
Malicious:	false
Preview:	.......6..M..M.(%.<4..4..;.<>V..H..F.#../.M.K......{...X.k.hB..{4....J.s...,..[..l.@..msq...Y..+,..=M..<.&.74...2.>~....U.m..G..^..)....o.K.Ku.aG..<.O.v...X.q..F.J.<~.....I.o....z.k......{...v.........4..JKx...]......G..etk.r.<'..}M...$....S..\'.. ........#f$.H..].].K.......K.`..(......F.6.2&a...m m.......C1....,.OgmCD......].NP......o.....W.).........M..~E...-..`.Zy.Bl.TJ0...v"~Y.:.@...~...U..d.&..... ....[[.....\.zc..s.<.l....l..2.._.3..z......l..F,:...+.x$Ct..dOC.d.^ig.A..7.+>......}---8+8*---50c4345d433c1c39e2e00a706874993b93357cac5cc15575579bb1fad6aa55f877ea078e44e0ea584e2af50b355d282747c88fe97bb33d653d3cc544fe4d3ab8dd214bc66d41404b134a8b718b3b434093472a7b0f50a616e16414dc5c7e23ec720991997b554a9504ff4e7cff16b0bc4703613eac0769d6ca020945fc4222ce43a17e1e43836d30e06b982112a4b10dd36da78e894e5dc263cd312510cda6837cdc85aae3b028e49007c8f1274905009bece7e26e4382ab4653e9f31273abcdf2fd1ba04318439630357b40620565503ae83699e0b685d83bc7f340e24477c4a07c5b20061fa

C:\Users\user\AppData\Local\Temp\5060135932.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.024133898813508
Encrypted:	false
SSDEEP:	48:3A13d/XFw/iz0IkrW4W1VKTRzYWwfiiU4zN:Qd/Xki4IkW1V5XJzN
MD5:	86C42EBA23B26EDBAA3FB8549254566E
SHA1:	88BA77ADBE9922DB8F17CEB0F912F340B3AB927C
SHA-256:	22E1FCD9527084040CFFC64E68C2C971D3717D2EF19BA297343EE80FD6D519F5
SHA-512:	79CC960060285AC67172DA05A1B30C0EB9DF430D35565E1B2932F108089A39D39A350EAAFBB4AEF949060DCB2927D029E6B10FA1CED5E350290FF252E53C79CA
Malicious:	false
Preview:	.......6..M....,..+.W....Cq>.qL..1N.ON@F..q...m....y.."y..Ju[...{.'-.' E.q.......q.$)c]lo.p1\g..Y.>...=...NQ(......q.K.7..p.&.#n.I..5...e.E.~.S..>...^.(@L.O.7mn..ioD.M9Ge(.:.....H..r...............#..k..~.tv.....z>...}.In.h.....GU>.;.t..9J...7._.!.5..H..x.k=..:e...e...A.Sw0.tk...J...M....pJ..N..8[...R....e..F.$..t...v...<bk....Rg.....#.5....O=......v...G....NA...&.Y.G....-.i.f.=.mM_...).4]...A.91..Gn...(w.B5....tb.L.a..i.uJ.RU-..b..1...J`1...m._......w..^..1.jk5...:+.gi.-L...0..TX=,...C9.'---8+8---50c4345d433c1c39e2e00a706874993b93357cac5cc15575579bb1fad6aa55f877ea078e44e0ea584e2af50b355d282747c88fe97bb33d653d3cc544fe4d3ab8dd214bc66d41404b134a8b718b3b434093472a7b0f50a616e16414dc5c7e23ec720991997b554a9504ff4e7cff16b0bc4703613eac0769d6ca020945fc4222ce43a17e1e43836d30e06b982112a4b10dd36da78e894e5dc263cd312510cda6837cdc85aae3b028e49007c8f1274905009bece7e26e4382ab4653e9f31273abcdf2fd1ba04318439630357b40620565503ae83699e0b685d83bc7f340e24477c4a07c5b20061fa

C:\Users\user\AppData\Local\Temp\5367203117.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.039368254674727
Encrypted:	false
SSDEEP:	48:6TOI3g697VWcx5iz0IkrW4W1VKTRzYWwfiiU4zN:cOEg6aWi4IkW1V5XJzN
MD5:	0134C40E4CB666504C02B2603E745050
SHA1:	BB0EF542EACD0DF929BF2BB2A210B5A5F23FA571
SHA-256:	618D547791A1097447F428F7F5152355E04283CD87A2D2D76CD7E54954AA098B
SHA-512:	79B20624ADF423ABC533335E7DF2393D75472A74CD485C357FBA15CC3B87DD793721E8C71B673586B60EDDCB8BC31276FC22955561A2E6558E9824AEB0780D30
Malicious:	false
Preview:	.......6..M..&...$......=Du...AO.r.....b).2V. d.....y.qc..3.N....M0.!..&G.C.&O...)(.^..f..{.p........t...+1.2....\|.....l.....l...Vx....._H....".P..@..v>.>.'ZP.(......]?..`5.@.....wl].......(....=....E.=[.Ol..o....M.........(o&$.:...q....t yK8..kBC...........{......0Q.....^r.v.6Q'..^....:t..M.g..F..IWN@......K.....m...>F0g.&r.h.K..m....N.....Z'..K..........Uj.4......~.d'5n....r. wvJ7........;o6..._!..[...F...b..@98W>.e.o_.=...:...>B.v...L..5Pe1..c~>.Z1\|w.[............#e.'...X..@~%O6.....`A...---8+8*---50c4345d433c1c39e2e00a706874993b93357cac5cc15575579bb1fad6aa55f877ea078e44e0ea584e2af50b355d282747c88fe97bb33d653d3cc544fe4d3ab8dd214bc66d41404b134a8b718b3b434093472a7b0f50a616e16414dc5c7e23ec720991997b554a9504ff4e7cff16b0bc4703613eac0769d6ca020945fc4222ce43a17e1e43836d30e06b982112a4b10dd36da78e894e5dc263cd312510cda6837cdc85aae3b028e49007c8f1274905009bece7e26e4382ab4653e9f31273abcdf2fd1ba04318439630357b40620565503ae83699e0b685d83bc7f340e24477c4a07c5b20061fa

C:\Users\user\AppData\Local\Temp\5622580005.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.027250706251024
Encrypted:	false
SSDEEP:	48:FiWw8E4k4x6pf9iz0IkrW4W1VKTRzYWwfiiU4zN:Fil8/Ef9i4IkW1V5XJzN
MD5:	31E240898B5AC87F30C50A909817819D
SHA1:	05AFB687FF1B49E5CB1F2A66BC200323991EEE0F
SHA-256:	4EF43824C7499F07BF9AC69DAE76AEA65FE5B69A61B0D69E8DC017F2CFC320D1
SHA-512:	863C75FA6A00C7DDA84C1DADB183CC7F48559EE58D864E862676DDAE4B87EA737611CF023D54AC633DD6825BAB31129B27E05C373A90FD2D98E45BF56DC43943
Malicious:	false
Preview:	.......6..M.x....,1....\|j._L[.1......8]w}8..j^..)...x..bh..P8z...."].....js.W.qQ...C?......3....Vo.f%W...2..I.n......:$...-....sg.N...X.(:.SLn.....F/.q...).Z.j.-W.<G.....vCX..D=X...._P..G..X#.....+...v..h;$V.@...mrd....lS'\|X.......KX29..J....f..."V!j..Zd...S...3@.d.N.....k.....K..R............v#.h%u..o.....n.'..x......53..c.}d.P%n....A.'01....VT/.;rq./p+..%.U...:..e.s.+9.\|D.....o.J...\ .}...y.$L..t.4.be...;.... ...XsZ.U.3..+#.Xj.B....T.....6.Q+.."i. .......W4.!..2]M.X./.ja.GF..Ha5.U....D.^---8+8*---50c4345d433c1c39e2e00a706874993b93357cac5cc15575579bb1fad6aa55f877ea078e44e0ea584e2af50b355d282747c88fe97bb33d653d3cc544fe4d3ab8dd214bc66d41404b134a8b718b3b434093472a7b0f50a616e16414dc5c7e23ec720991997b554a9504ff4e7cff16b0bc4703613eac0769d6ca020945fc4222ce43a17e1e43836d30e06b982112a4b10dd36da78e894e5dc263cd312510cda6837cdc85aae3b028e49007c8f1274905009bece7e26e4382ab4653e9f31273abcdf2fd1ba04318439630357b40620565503ae83699e0b685d83bc7f340e24477c4a07c5b20061fa

C:\Users\user\AppData\Local\Temp\5713452101.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.063649018265747
Encrypted:	false
SSDEEP:	48:ASKq88oNiz0IkrW4W1VKTRzYWwfiiU4zN:YrNi4IkW1V5XJzN
MD5:	6B1C212226743DD9B3BCEFAAE34FC28A
SHA1:	E1EF0F92DCF553E3E1C09F8341E1F8571840FB98
SHA-256:	DE9F4B47731E7909D291DD87996D625BCE542998E920EFC7A33983CAEB87E0A5
SHA-512:	B4253870A8159A482BD0990A921C106634FF47BBE040CCE25C2AA1D17C4CB8B05BEBBB6F81F568C8A5CB5114E70D3E86C2BE2CB297815735E983A6211EC50F3D
Malicious:	false
Preview:	.......6..M...Z6...5re.:.f.l1.<.....U...Qs...."..hCM.+D.d...w...p.....K..(..O.k\.V@..:G=..S.m...\..G.)...T........`i..}.#..I.m...Act........V...1.C...4.}.\|......K...y.:..5@.^.....f.&.+..n.u.x$.SK.L..2C......`....E..4.l..x....t..V0.!.Q+....PC.......P.C..."..C.e..'.M.w4....&..gZ_...U_p......bA)N.......?.A...=..Vg.,q.#H.D.x...Rt>.%...p.Z..J.4j........)..`.}uX...<[?.t..k..a...`.`....7.8<....OK...(`.R.1.T.f.J...._@.....R...O..."....&..6.i...c"....l...&......I./...>.4Q..H...;C..x...y..lc. .'z-.&H.---8+8---50c4345d433c1c39e2e00a706874993b93357cac5cc15575579bb1fad6aa55f877ea078e44e0ea584e2af50b355d282747c88fe97bb33d653d3cc544fe4d3ab8dd214bc66d41404b134a8b718b3b434093472a7b0f50a616e16414dc5c7e23ec720991997b554a9504ff4e7cff16b0bc4703613eac0769d6ca020945fc4222ce43a17e1e43836d30e06b982112a4b10dd36da78e894e5dc263cd312510cda6837cdc85aae3b028e49007c8f1274905009bece7e26e4382ab4653e9f31273abcdf2fd1ba04318439630357b40620565503ae83699e0b685d83bc7f340e24477c4a07c5b20061fa

C:\Users\user\AppData\Local\Temp\5795694722.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.052969709027852
Encrypted:	false
SSDEEP:	24:mLaTr381eSK4PEulZUtotic2OO4NIIeOvBiogFfAWrxUh6KTRdISYk/38UafiMR9:mIsgv1uiz0IkrW4W1VKTRzYWwfiiU4zN
MD5:	306A240CB732E8E67AF53BE5A2582B53
SHA1:	4FED8308EBB9E75B26404DFBACDE0653D46F9598
SHA-256:	25572FA9817DA5584D13F55B10993ACFB7FEFEAB867AED403E2DD2302BCBA1C3
SHA-512:	67D564B204A30A74276E9B7726B033195572EA88991572570D30E51CD66FC43D0393F9D12A503CCFC090D9669B21995E114F75C78D75742016521757EB88601F
Malicious:	false
Preview:	.......6..M.T...l...J..?.&.4]..q.......D}...\|.2..bD)......a.g3}t....'.FG)....kwm.........!...x.#x..{...s..u.b..@.w..O......).u..~L...........3.(<...E..n.&uu.B....NS.F.]..V..4...............8...w.N..$.........V.Xx....Ix\|...w..5......r.r..+.../8...'..U....D...Al...u..F...."F......l .h.A.AH0.R....kOM...ca...-...[O...?..(..l.Y.n..x.........ac.N...vj...bk...Q.&.FT...J_>.Q...x..R..\|.?.:~.7..t....PO8,]E.Q.Y?.......>.h......A.$P....N...-..e.'w.~F..r.<..e0W.Pb.....[". .BCcM.0y...-..C..k..K.Af.---8+8---50c4345d433c1c39e2e00a706874993b93357cac5cc15575579bb1fad6aa55f877ea078e44e0ea584e2af50b355d282747c88fe97bb33d653d3cc544fe4d3ab8dd214bc66d41404b134a8b718b3b434093472a7b0f50a616e16414dc5c7e23ec720991997b554a9504ff4e7cff16b0bc4703613eac0769d6ca020945fc4222ce43a17e1e43836d30e06b982112a4b10dd36da78e894e5dc263cd312510cda6837cdc85aae3b028e49007c8f1274905009bece7e26e4382ab4653e9f31273abcdf2fd1ba04318439630357b40620565503ae83699e0b685d83bc7f340e24477c4a07c5b20061fa

C:\Users\user\AppData\Local\Temp\5859486270.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.024332827560528
Encrypted:	false
SSDEEP:	48:O6bjdQHzCTZiz0IkrW4W1VKTRzYWwfiiU4zN:O6bj6HzCTZi4IkW1V5XJzN
MD5:	C8568CB65E2802B1239C0CCA1D6FAD3B
SHA1:	70B9030A30F9BE67E3B23A21440461AA49B2FC03
SHA-256:	9566290F386D567A5C66606C814CFC44D7553E8038DE76742B7D02A5C5A1D9E7
SHA-512:	25A715738B414F3944BDFD0E67FCBF2F04757B7C924CECB2F5A0E4F4BB0741BA71AAF1A075FEAA6BC0947974F9D14230B8B914B1AB555230DA12038B50FA6326
Malicious:	false
Preview:	.......6..M.n9.d\.7..y7.DY.J].Y#..b3.... ..1i.=8..4...Bz..j....m.A......H.....vn.....#H.........T...!.-.^]..D.\|..DE.t 0...RcgjJ..l..Z..RO.(&t./..\.]4I`..w9dKL._.R17(J.z.d..P..U.7=...N.j@.....~.O.vd.q.'Q.".s...a..).i..&t...p>5..\...8..(..z.O.2 n.zM.yl....iVU.:Iz....I.`.UwbN....=7$..W.s.......F....[.Y.....K.z..%j;.....n.............6.{f.....JW.i.#.0.C.H..2sh..oE@6.=..ni..{'.STcs..x.............m1....P.L..pN<a.HN...>.w.....}..E..N._.Hp.Y..U....$!.>Z...3,... ...d..@a.s....}f3H`_......$....&.#...w8(Bts---8+8*---50c4345d433c1c39e2e00a706874993b93357cac5cc15575579bb1fad6aa55f877ea078e44e0ea584e2af50b355d282747c88fe97bb33d653d3cc544fe4d3ab8dd214bc66d41404b134a8b718b3b434093472a7b0f50a616e16414dc5c7e23ec720991997b554a9504ff4e7cff16b0bc4703613eac0769d6ca020945fc4222ce43a17e1e43836d30e06b982112a4b10dd36da78e894e5dc263cd312510cda6837cdc85aae3b028e49007c8f1274905009bece7e26e4382ab4653e9f31273abcdf2fd1ba04318439630357b40620565503ae83699e0b685d83bc7f340e24477c4a07c5b20061fa

C:\Users\user\AppData\Local\Temp\6092905029.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.013861298206603
Encrypted:	false
SSDEEP:	48:+4f/Y/Vn8mL5Kiz0IkrW4W1VKTRzYWwfiiU4zN:l/WVn8mL5Ki4IkW1V5XJzN
MD5:	5608B50381689139FF53B62469A9F610
SHA1:	808A80EE6A9BAB10977FEBE955295275429E8877
SHA-256:	E9D91BBA8FC7DBF1970DA2CCDB538E890A90A807F43D29BE3C555756089B9CDD
SHA-512:	A41170CD9BE29C9E7F1C8AC54000BA5C08668ABDCF17C41FB41F04FAC42E1EC9C8006B1E017A64A8ED2618FA78E3B8DC49B609E766278BEF561BAD507B9A0C6B
Malicious:	false
Preview:	.......6..M.U..X..?.."..H.....9!.......U..w...1......l...T6.....7...0.8(_...E..5.....,.......-...k$E...ld......2.6...$...w.>.?@$.+.^b -b..H`.73..L...F..G.. 4..T.cxW..)7.j... ..4........}TjA..,...U..s._..o...SkH.b.......k.H...+i;.......iD$S..O..0.dU.....z.`...'aU...f.!{..A.yP..93..X.;....E'u..._......!rI..7s.N..\|..=.~V.9P..\|L}.........j!....V.......Z....'....V...@.!.~.u.0.....M..a...).I5.PV.....u.......gM.%MX.\?...;.u4.....j....k.....\|...y..r.>.f,.u.w.e.........J.u.&..4s.'.>...)....a.G.<.V.S'r...---8+8---50c4345d433c1c39e2e00a706874993b93357cac5cc15575579bb1fad6aa55f877ea078e44e0ea584e2af50b355d282747c88fe97bb33d653d3cc544fe4d3ab8dd214bc66d41404b134a8b718b3b434093472a7b0f50a616e16414dc5c7e23ec720991997b554a9504ff4e7cff16b0bc4703613eac0769d6ca020945fc4222ce43a17e1e43836d30e06b982112a4b10dd36da78e894e5dc263cd312510cda6837cdc85aae3b028e49007c8f1274905009bece7e26e4382ab4653e9f31273abcdf2fd1ba04318439630357b40620565503ae83699e0b685d83bc7f340e24477c4a07c5b20061fa

C:\Users\user\AppData\Local\Temp\6422942404.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.043364017995295
Encrypted:	false
SSDEEP:	48:c78MSKTXOGiz0IkrW4W1VKTRzYWwfiiU4zN:NsOGi4IkW1V5XJzN
MD5:	8CD011F7B9A7029194556A32A950EBFA
SHA1:	B7D5CC90B8FA12CE97E13D262505E7C15CEA824A
SHA-256:	F30AA614A5CA8657727D96F22D0116AB58C569856D5818AB3487EC70234071F6
SHA-512:	D8F8AD10F1EACFCEA3F5A2E206E03C4AC61FE715C3D24B9D73586DC34424C8C27F581D3DB5CFA483F798457FBAE3B2E1AE6120514800B4C2207C4206961D5409
Malicious:	false
Preview:	.......6..M..0..]V.....$..9p.p16l3.`8.>.w./D.2k"..r..{s.K....3l{..w..t...V."(-.].\D6.......\V=...7..`....U.i.Qt....hf<=dj....q..,.kg.$x..R..]...q\.h.0.i....E...6.w..3.p..0K...:..z..b....!.JZ..&4..;...C%zq..a...".D.!..IHj}z....{6........F..u../u:....J.X........>...#b.K[f% ..)g&.....J..16..........<B......Y{........~...;.$8....%.h9.h,....3..\|e9..A.\..,M...z..S.A....C3..TY......4..C/.r..3.k,.....'...%G..].._..XEK.~....K..n..Fi^O...-.....a....^...+;I...)..\...E....[......F.V.s....O.\.". .---8+8*---50c4345d433c1c39e2e00a706874993b93357cac5cc15575579bb1fad6aa55f877ea078e44e0ea584e2af50b355d282747c88fe97bb33d653d3cc544fe4d3ab8dd214bc66d41404b134a8b718b3b434093472a7b0f50a616e16414dc5c7e23ec720991997b554a9504ff4e7cff16b0bc4703613eac0769d6ca020945fc4222ce43a17e1e43836d30e06b982112a4b10dd36da78e894e5dc263cd312510cda6837cdc85aae3b028e49007c8f1274905009bece7e26e4382ab4653e9f31273abcdf2fd1ba04318439630357b40620565503ae83699e0b685d83bc7f340e24477c4a07c5b20061fa

C:\Users\user\AppData\Local\Temp\6483516391.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.045561786693176
Encrypted:	false
SSDEEP:	48:/nz8K5k/riz0IkrW4W1VKTRzYWwfiiU4zN:/z8Sk/ri4IkW1V5XJzN
MD5:	60B57B9A643AB6E7C7CDFF3A95992034
SHA1:	8C5FCA188F53120A9F9DEA86442633500B00CDE1
SHA-256:	D26360C9C6826DE76C40F84DC6EFF381999DB0647D35DC169463B90637486143
SHA-512:	2B34B5E7DEC0905BE3FA3EA651AD351F4A667899AB2DC4A4F6350A0D2322AC313E7E6059BB21CB3505CA74384353A001709A3F753C79C6A6C0DBD14E83490D87
Malicious:	false
Preview:	.......6..M.]..\?/.d.:~3W:.....lm._.?.p.....%....Z....0.<........QNj./..dE.m........8_-...J3;@.l5...~(....Qd.../SW-.A.N..L..$...by.Tu...Z.m..9.X.....h.I.....r .$Je.....u..YoQp...?{.........]Uw. .n..P.....pb../......F.1u..Y..52.<........F.J...........,.J...+..D..>.x...=B.....g..b<U.m\|....Th.\7'a.../6tV.I{..i.I.Q.g..k....Qb.@....]....?.... 1?.1...K.......{......l....}.A.'..WFG...........&.....N...F~ml...+..JR.........0..wl..[.^...gC/."..g...c6Z.G...._../v....<.........^J.....4.]{.\?Q..!.$g.P.---8+8---50c4345d433c1c39e2e00a706874993b93357cac5cc15575579bb1fad6aa55f877ea078e44e0ea584e2af50b355d282747c88fe97bb33d653d3cc544fe4d3ab8dd214bc66d41404b134a8b718b3b434093472a7b0f50a616e16414dc5c7e23ec720991997b554a9504ff4e7cff16b0bc4703613eac0769d6ca020945fc4222ce43a17e1e43836d30e06b982112a4b10dd36da78e894e5dc263cd312510cda6837cdc85aae3b028e49007c8f1274905009bece7e26e4382ab4653e9f31273abcdf2fd1ba04318439630357b40620565503ae83699e0b685d83bc7f340e24477c4a07c5b20061fa

C:\Users\user\AppData\Local\Temp\6516896632.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.0236997024793935
Encrypted:	false
SSDEEP:	48:zXwF4WNEeH6iz0IkrW4W1VKTRzYWwfiiU4zN:U1gi4IkW1V5XJzN
MD5:	5E362CA0525157B3489A454ACD4D0983
SHA1:	A00FCDF051D371546D48B71CF35025B791FB02F8
SHA-256:	76865DECEBD97CF6EC2B7E855FAFA28B95BFABB6D201327AD8F5B3E61268C51E
SHA-512:	AAFBF2AE55B6C5A3F149B27E59E449FF7997B30CDF11CA95092506342C5E83F026B90633F5E3804EAE04D57B4FBCCDB6BD72F29FCA8EB691108B5FEEFCB3E98C
Malicious:	false
Preview:	.......6..M.q..pG...M3...S..a.dU........$.j.)z.p.`!....y.......k32....dW..=...P.g.7.....K.....Q+(...)X.I...R\|.....=nk....y....Lm.w...d..sT....(...V.c.c.k...>.1.S4<P..4rTp..;...!H[M.Ks%...&.......-.f.Jm...m....MW-b....x.q..y.p.Z.R..Ql.k..:".Q.W.hL....p....I.3]e[;.`S}......pU.e.....X.&.E..5..;.M.8..0Fm..4=!l..........M.J........p.........fQ.Y.La...;.ic..81...6.q..I..}0._.....-..XB"5,.O1..D.M).WB.._..69R<n=M...l..#..G9.~........O..{..D1k.h@.i..V..-..o...[.. .M..o.]AI.8.J..U\...N^.......v..p^.---8+8---50c4345d433c1c39e2e00a706874993b93357cac5cc15575579bb1fad6aa55f877ea078e44e0ea584e2af50b355d282747c88fe97bb33d653d3cc544fe4d3ab8dd214bc66d41404b134a8b718b3b434093472a7b0f50a616e16414dc5c7e23ec720991997b554a9504ff4e7cff16b0bc4703613eac0769d6ca020945fc4222ce43a17e1e43836d30e06b982112a4b10dd36da78e894e5dc263cd312510cda6837cdc85aae3b028e49007c8f1274905009bece7e26e4382ab4653e9f31273abcdf2fd1ba04318439630357b40620565503ae83699e0b685d83bc7f340e24477c4a07c5b20061fa

C:\Users\user\AppData\Local\Temp\6880980688.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	6.044482102528358
Encrypted:	false
SSDEEP:	48:Z6zLe5qQgBy16bDSP0zkB00VSTo5zKd/67:ZoePgE1ESP0AB0lUe/U
MD5:	2A190A17471867D38F3687483013CA8C
SHA1:	D7D91092A9FC529F771317372ECB102CCADE0B56
SHA-256:	95723AA8E7FB8E1F557666E363A3D4D9EFA255FE7A2FCE209478870167C69C2F
SHA-512:	75447818E1CD98D9B335B7E8E8F5588604007ECBFB20A0D1C34578E285591120923C6D8F4A9F0B8F4E3CC32DBFBF74BABF1F341CA866B3C4A425228FBC348F72
Malicious:	false
Preview:	..5.S.Uu]..bax....^...:.&.$.Ez0.FsANz.Dp......o...>..tM....}.-.Ka...F.%...LH....7y..f..;b..z......M..E[.0=N..../._....w/......(<)G+..2...`......l..P..rN.....!BXw....O1.&..\.<.]?......z..5..^.....NJD.....4a. ..y`......W.3E.2S.9.....t....t.Y.`I{\|..w"$..ly..Y..N.UL.l..(....!.h..}ZL.....)(\cI..?.y..(a..>.TO^#.,.."?....,........%.\|hE)...x....?....<AG..\|... ..~.......h......tFqS..\|SJy...E.o....J...e.\|.&.Lo....r.'.!.....~o.EYN[B.@.G.7..O......Vh.kJ..EW.....U?.x..L.y.-0........f....ke.(6..b._Ej7...J..E..---8+8*---2fce8ef0cf9d0d99ef3f4bc44b5d4f60666b7d2109b4b7067da003e519c87cf3a9f04a472ed27d238f1b1dc7020c11719fd01ff4133f62609bb7b65332e428810d0069cd93ee9e5dd40d5efa1893df305ea35ae4caa71d17829004a76a11c28e83be955f3ec00a8a1619e830d9f19768a984eb2853552a30102d1d2fc5edb8328481e8a41866b2b0d43e1848e3c3da65c972886e775fda902cf8fc67ed5fdc97b3df755a2bbade18e1451fb22994286739f4dbddf926ed9055466389a2afeb11eb950aea6ad0adbe61b71c14de28e111799af7508238396ace62b8954f98352859bebb0620757

C:\Users\user\AppData\Local\Temp\7011884383.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	6.037930075389627
Encrypted:	false
SSDEEP:	48:Z6FyRW9z/uyiobDSP0zkB00VSTo5zKd/67:ZxQJPieSP0AB0lUe/U
MD5:	C1A15FA89DD486254BAF0EE9AE42C373
SHA1:	36A0883A2AF98DEC70FF5B45AB0E4DE0C616F712
SHA-256:	0C6188551F37772062AC0B83B66132573906B370FE312F32BA841189BB113BF9
SHA-512:	180A719F4C97F415012AAFD418CD8250BB54394E5E0143AD0597E6D9B5EC3EDF81232A5E179143D404EC610D6FCE6B48A555A7F99E3541BEC978E4215095E5E9
Malicious:	false
Preview:	..5.S.Uu]..bax.vu.%...-..M.x@..R5..~..?m.p..`..8;..z..QL.<l.uN.W....B.].4?.H.L.....A.su.0.Q.(.....P..[.).....O$..........Bq..a1..M]...Q...W...fw.P........b.<.U)L..w.........I..`..0.\|........J.SN...^..),..R.. 9...`..L....zYb..q.5..H..i.f#..2P.g...>..;..s..o^M7FV....Z...".,O7.ei..C..Vi.3m....EQ5C}6..XM0.m....Us..M..j.+..w....>.....F.......(....Ax<.9._...;.......V....Bn....".n.u,......m.'.}%.Jw.h..~x...`.!1...%.gcT....x....J.l...b<V..u....i#..b.3\|.....E1.M>..tQ.f.c.s%.z.= k..@..e.W..&..&.s0....'n..---8+8*---2fce8ef0cf9d0d99ef3f4bc44b5d4f60666b7d2109b4b7067da003e519c87cf3a9f04a472ed27d238f1b1dc7020c11719fd01ff4133f62609bb7b65332e428810d0069cd93ee9e5dd40d5efa1893df305ea35ae4caa71d17829004a76a11c28e83be955f3ec00a8a1619e830d9f19768a984eb2853552a30102d1d2fc5edb8328481e8a41866b2b0d43e1848e3c3da65c972886e775fda902cf8fc67ed5fdc97b3df755a2bbade18e1451fb22994286739f4dbddf926ed9055466389a2afeb11eb950aea6ad0adbe61b71c14de28e111799af7508238396ace62b8954f98352859bebb0620757

C:\Users\user\AppData\Local\Temp\7046727858.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	6.025925170366659
Encrypted:	false
SSDEEP:	48:Z6Fnwl6GNYFTDYSiUHIbDSP0zkB00VSTo5zKd/67:Zhl6GNYFDeSP0AB0lUe/U
MD5:	B5E739F3CAA74285B800F263ACF612AE
SHA1:	30B28AC2B8F5FC760A3456080D25BDC2A58F2300
SHA-256:	935526911146FDD8DBB33822B94ABBE71A4C656236332621954B7BA0EE46740C
SHA-512:	F137B9E2C24610A34AA5D7C4E61B67408257523550CAAEFD35C3318224D89F5965A8B4E11F77A18CC3BDFA71DA8E4C06436806A72D06ACB94A785E5EB7CEE780
Malicious:	false
Preview:	..5.S.Uu]..bax..(!=..6>0.../.oHt......7..v.._2."....!..yD.....S.9W.,..LF%.@+Y?~...Ig....5eL....Z.....R..`..Q7.m/...o2/..F\....BP..y.`A........4.<.^S.lM.C....P_...#.xXM..h........J.Q%.a......+.1.jV.5U..z..?.......u.[.d..a$.. ]...:l6..M...W ..h............b...%p^VR..L..i....a_WA0.....;.1d8...VDH......\..\R.Q...h......4..YFq..%.....Q........~.......SD..5...o.(.v.....eGM!#..t4.t\:...Z...r9w.#.=.{.3n...k...).-.?H.HU.K.....a`."...1\|.%.1.w4...v.{.\|G......Og...-...k.....!..!oH...:...Xr-....xZbq.....P---8+8*---2fce8ef0cf9d0d99ef3f4bc44b5d4f60666b7d2109b4b7067da003e519c87cf3a9f04a472ed27d238f1b1dc7020c11719fd01ff4133f62609bb7b65332e428810d0069cd93ee9e5dd40d5efa1893df305ea35ae4caa71d17829004a76a11c28e83be955f3ec00a8a1619e830d9f19768a984eb2853552a30102d1d2fc5edb8328481e8a41866b2b0d43e1848e3c3da65c972886e775fda902cf8fc67ed5fdc97b3df755a2bbade18e1451fb22994286739f4dbddf926ed9055466389a2afeb11eb950aea6ad0adbe61b71c14de28e111799af7508238396ace62b8954f98352859bebb0620757

C:\Users\user\AppData\Local\Temp\7155756679.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	6.037731395320161
Encrypted:	false
SSDEEP:	24:Z6j5zdMYUXolz3KBNs8VFbD+BPn0emA5Rb0BuVeFTcrdBwCtxbGMyew/67:Z6j5xkogNlbDSP0zkB00VSTo5zKd/67
MD5:	CDFB53CB56ED7A2DE492E2B805287BE1
SHA1:	08EF10176EC0A29820D943035C55C367581AA8C4
SHA-256:	52A6F7CC677B7D370F7A97E634E66B6732B8E62D8D7CEB79FBC8CA9EDD261F5C
SHA-512:	E8E27F80373F18A82967A0C992D283642684834B102131F59040ECA50EC555D180285ECEDF66D28BBF72D0149AE0A5E8D14561256E4E284B88595483A3B1AF80
Malicious:	false
Preview:	..5.S.Uu]..bax.v1. 0V.iL..{...cl.y...@.....S...{.-.H...4z.V..)t.TPzt..vL...CW.D=0.LZ.h..3......p.;.N,.[.^.O+.....r.c}.~.H.b..8.>...X.\|:9t4.. v.....I._.Pb.x....{..L.<........X.:......s\|"1:....:.e.......M6$....l...Gff_........G.P...7..x.?w..g.yg.z.,g.)..t.......J.b\.@........=.j...fPX!....^P.......1.....o>..x.. .....!..={...{..m....Cz.[..uD...T...r<..S....:..$......j.`w..jRh>.R.aX-..s6......w..c2>.5$Xn4#....<...........}.A...%.0.2xv.6....i. d...$.<.......[.....y..v)....?.uA..s~.w,S../..}.;.O=i...=.---8+8*---2fce8ef0cf9d0d99ef3f4bc44b5d4f60666b7d2109b4b7067da003e519c87cf3a9f04a472ed27d238f1b1dc7020c11719fd01ff4133f62609bb7b65332e428810d0069cd93ee9e5dd40d5efa1893df305ea35ae4caa71d17829004a76a11c28e83be955f3ec00a8a1619e830d9f19768a984eb2853552a30102d1d2fc5edb8328481e8a41866b2b0d43e1848e3c3da65c972886e775fda902cf8fc67ed5fdc97b3df755a2bbade18e1451fb22994286739f4dbddf926ed9055466389a2afeb11eb950aea6ad0adbe61b71c14de28e111799af7508238396ace62b8954f98352859bebb0620757

C:\Users\user\AppData\Local\Temp\7244716724.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	6.053401785594984
Encrypted:	false
SSDEEP:	24:Z6IvPyzs0pKSncEGK4FbD+BPn0emA5Rb0BuVeFTcrdBwCtxbGMyew/67:Z6IvEse3YbDSP0zkB00VSTo5zKd/67
MD5:	8A7057954EA1FB5747D2F0A5F939CD39
SHA1:	FAAFBCBA9349771AF9D8F7CC649CEEFAACE4D30C
SHA-256:	9098529010702A59EFF7A2FE24373AB3CB1F00A141272CB775B3CC434A1ECE6B
SHA-512:	C57BD9A87C18287F78A598FCBCDFC37F62AA7FC480D061A80AD8AFA994D0EC571B5CDAA85557605F49F8D09BFCC97207FDEDCDC782D3ACF44B1888777DB31108
Malicious:	false
Preview:	..5.S.Uu]..bax...B..`Nh......Kr..xF....N...p.I.~...........C.......D..3..tw..02....._.q......Ea4....h...!....`.`$..:z."..F{...,Q........X8a."y...].<\L~.R-.7..v.....S..X.{.Y...+..#..H..j4.,t.1].W&c.I.R.......Pb.<]ue...........O1.!.y.B..IB..i..%./@5D.LFY...g.<.T.+1..ER.$..z....d.<..;...l../. .T...b.........v..]...X......#1.;. ..1BK..N.H.....p.{.5.(...NV%Y.FB.....s...be.m...f........s{..Q......;.:...aD..`I...YD.g..V<.R...v..=.i.....nU....$....R...jS.Z.=.. @L....J+..@.T...Y.<5..<q.A.P..].......S.---8+8*---2fce8ef0cf9d0d99ef3f4bc44b5d4f60666b7d2109b4b7067da003e519c87cf3a9f04a472ed27d238f1b1dc7020c11719fd01ff4133f62609bb7b65332e428810d0069cd93ee9e5dd40d5efa1893df305ea35ae4caa71d17829004a76a11c28e83be955f3ec00a8a1619e830d9f19768a984eb2853552a30102d1d2fc5edb8328481e8a41866b2b0d43e1848e3c3da65c972886e775fda902cf8fc67ed5fdc97b3df755a2bbade18e1451fb22994286739f4dbddf926ed9055466389a2afeb11eb950aea6ad0adbe61b71c14de28e111799af7508238396ace62b8954f98352859bebb0620757

C:\Users\user\AppData\Local\Temp\7245361316.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	6.019570478283498
Encrypted:	false
SSDEEP:	48:Z6ZczI+xvW33Tl8SgqbDSP0zkB00VSTo5zKd/67:ZycM+xojmh0SP0AB0lUe/U
MD5:	84F16A30C431E5DF9F3CA161F2B19409
SHA1:	D7F666FB6EAA63EB64304681D97389D60025C2B1
SHA-256:	86C6C9A36D40FE7FF5671B64BB8F4DBD96947DFC8D4D8577560C7C1352324FC9
SHA-512:	B6D027C44D0FED2B29CE84C4593C0C438757618964EC0C431874A39F0D80B03E15E84D92464E95762CBE37B190716ECC482F93CBF9EA2B6D67EEC772E5E73D5C
Malicious:	false
Preview:	..5.S.Uu]..bax.s..h-......".K..'.s.G....Z.\|8sm.Qh-.i6Y.pP.Lf.u...\..<?.....#xTD.......'E.....!6.H.s..a..4.\|-}..>. ..n[d7.Y{....'..u..q.I.Dc.`..+.}l.,.../.p.3)..Q..YQk.9.7.......O1.8.].@.I.1[._..).}..xtj..L{..Nt<..Z.5K.\,..\|..k..............}....<..^..c...J].~./......t..ZG....n.u..\|..k.?.../.9....%1...mf.gE.h:3.s.....g,....oI..bH....\|....'..h..d...!ZPBc#.o....+.C.....b.'{......;n.h..&q..-..U3xR..om.$@.v_-.J._N..3.).r......)j..z.E....\.pd..a.....b.&.]....g..X..4Y......m.7..qj@.%..C..+....---8+8---2fce8ef0cf9d0d99ef3f4bc44b5d4f60666b7d2109b4b7067da003e519c87cf3a9f04a472ed27d238f1b1dc7020c11719fd01ff4133f62609bb7b65332e428810d0069cd93ee9e5dd40d5efa1893df305ea35ae4caa71d17829004a76a11c28e83be955f3ec00a8a1619e830d9f19768a984eb2853552a30102d1d2fc5edb8328481e8a41866b2b0d43e1848e3c3da65c972886e775fda902cf8fc67ed5fdc97b3df755a2bbade18e1451fb22994286739f4dbddf926ed9055466389a2afeb11eb950aea6ad0adbe61b71c14de28e111799af7508238396ace62b8954f98352859bebb0620757

C:\Users\user\AppData\Local\Temp\7454812183.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	5.994720141884073
Encrypted:	false
SSDEEP:	48:Z6rfDfy3B0TwJzbDSP0zkB00VSTo5zKd/67:ZIyx0uSP0AB0lUe/U
MD5:	B0D13BB5E52B503B888BE784C23087AE
SHA1:	3A4D06392C6F03CD0E8770E001A95097C09AAD17
SHA-256:	279BD3B9DE5E5EF4FF5D3B6E8EC18EA79CD194AFA3CAA792B1D4889A8E88E2A5
SHA-512:	742C2A2E57CF32E26580D2F1D2FA3D71FFDFB2264D2BBEC30520C6C3B6C09BD85C6EECB26BFFB957827C87881EC3A02E5955C61E673297BEE511A5F0F763A3C5
Malicious:	false
Preview:	..5.S.Uu]..bax......)8....a......-...(p.}..p...p...:.pI.JwrA.5..l.b.tq.........5..3....S.rn.;d71.pL...2s...lh-9..\.ik..I6........c.S.M.......U0j..I.\hK....r6.y.Z.f/..O~.%.r.:.=Y,4.-.....4......+........47.$a"...W.h!..YBOz.B4......u...W..`.....?!..?...'%...}....U..gdmW1V..Hu.Q2.5.<.[.k.Y$bt....#....$...]h..._....w]kj.@g..X.d.:.y.}^..d.x.g3.x..VsFzp.-.......#b.:V..E.,.p.@1.qY..5......cZ.^..}'...gN.D...Y..S...q.AY....L}..V.o._...u}..T.......7.HMU.^1.c.62Q..D..H...8......A.Qr1....Z.Qii.....H.E.---8+8---2fce8ef0cf9d0d99ef3f4bc44b5d4f60666b7d2109b4b7067da003e519c87cf3a9f04a472ed27d238f1b1dc7020c11719fd01ff4133f62609bb7b65332e428810d0069cd93ee9e5dd40d5efa1893df305ea35ae4caa71d17829004a76a11c28e83be955f3ec00a8a1619e830d9f19768a984eb2853552a30102d1d2fc5edb8328481e8a41866b2b0d43e1848e3c3da65c972886e775fda902cf8fc67ed5fdc97b3df755a2bbade18e1451fb22994286739f4dbddf926ed9055466389a2afeb11eb950aea6ad0adbe61b71c14de28e111799af7508238396ace62b8954f98352859bebb0620757

C:\Users\user\AppData\Local\Temp\7606393495.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	6.001298910965372
Encrypted:	false
SSDEEP:	48:Z6NpZiSduhrV6bDSP0zkB00VSTo5zKd/67:Z8VduhrVESP0AB0lUe/U
MD5:	9C543E82D2E4F34FC55229D44863A5C7
SHA1:	ED7AB93824A49251DA007F70324274B98EAF880F
SHA-256:	316A3A1CF72028B726AAA4D866A8AC75E12695968079F2ADC12199FE02AC32F0
SHA-512:	5521F70A5DCECEE12BAE878CEF7E63853E853B8FD2047839596E50EBCAD7402546AD7713AECE9E536E72E270D1E65A2FC7356E8D83F8BEB7EB69671188FE9B42
Malicious:	false
Preview:	..5.S.Uu]..bax.......=.v.-!.[$..Rv.v^.~1.....]...2..>....2J.nDC".............~~.v.b.i\|..M...g..!?..Iwb......y#O...).MZ ..W.+.L.....0.O=..M..#..9..<fK.5y..d.....wj5m.w..t.....mM..T....w....za.{...i2......n....,.8R.;..iw:Q.Y.IT.^c.9.R......A$...7..W.Ic..ku.NK..FK....\O.ZlY"_.I.8...v.(N...........H?.a..........A.i..4W.9x...[0nw..c.`..ov.W\%......S:..x.9r+.....[zxD..n...[Al.~.u.......vx.].>..x.:...j...~b\|.=;.Ne..8.cB.R.R.%.../Z..RR.t.H.....[...4+.n...A....n!.<..B..4.l....8.....3...I.:.a:2h---8+8*---2fce8ef0cf9d0d99ef3f4bc44b5d4f60666b7d2109b4b7067da003e519c87cf3a9f04a472ed27d238f1b1dc7020c11719fd01ff4133f62609bb7b65332e428810d0069cd93ee9e5dd40d5efa1893df305ea35ae4caa71d17829004a76a11c28e83be955f3ec00a8a1619e830d9f19768a984eb2853552a30102d1d2fc5edb8328481e8a41866b2b0d43e1848e3c3da65c972886e775fda902cf8fc67ed5fdc97b3df755a2bbade18e1451fb22994286739f4dbddf926ed9055466389a2afeb11eb950aea6ad0adbe61b71c14de28e111799af7508238396ace62b8954f98352859bebb0620757

C:\Users\user\AppData\Local\Temp\7838756049.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	6.02334193786399
Encrypted:	false
SSDEEP:	48:Z6oWKEs1LXNBabDSP0zkB00VSTo5zKd/67:Zzj1LDkSP0AB0lUe/U
MD5:	BE856C04B0C7075E844D58235D822ECE
SHA1:	C2A643DD04C30AB03FC9A70040B16A2537AB3648
SHA-256:	AF99BBDC82A4317696B7790649FB4DC0C194FD25039AFE7C6E1D6914CAD02D9F
SHA-512:	3F801EFD82693E95A3D3B64295043E023DB394ABC7F1F62E8FE8D23EFDCF327E8CDD51405D1D57EAE5F4CA5DF87498FBC877372E0F1C4C3176D7CF5B98B8E31B
Malicious:	false
Preview:	..5.S.Uu]..bax..5...s...L}%..=..}C]N.7.......$$A+.T...\|.{P0..-....O.Of.j..;z.D)....".1,....\..C7^.1a..Ao.z.{b^h.W.x...vo..j...1...'.....T.%......98...:.....v...z........a..K._..d..AQz..q.>....T,8..c7g...:....<.w.y.....)D...q..t..w.$wq...............f5.;.hqk.QN.+..}.....j...R.X.a.c.6r............ary=y.]..%.-..w......t.%.+..._/.?H..A...~../;. ".N.f6.z.}...@i.M....a.e].Z.6P.........4..L....(.m8.8...I..u..4..#>.94..<b....3......L ~OgY..`{.xWV...'..>3Y..../...M...>._4..^..}..V..L>...../,...#q..&..@.B....v---8+8---2fce8ef0cf9d0d99ef3f4bc44b5d4f60666b7d2109b4b7067da003e519c87cf3a9f04a472ed27d238f1b1dc7020c11719fd01ff4133f62609bb7b65332e428810d0069cd93ee9e5dd40d5efa1893df305ea35ae4caa71d17829004a76a11c28e83be955f3ec00a8a1619e830d9f19768a984eb2853552a30102d1d2fc5edb8328481e8a41866b2b0d43e1848e3c3da65c972886e775fda902cf8fc67ed5fdc97b3df755a2bbade18e1451fb22994286739f4dbddf926ed9055466389a2afeb11eb950aea6ad0adbe61b71c14de28e111799af7508238396ace62b8954f98352859bebb0620757

C:\Users\user\AppData\Local\Temp\8134354090.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	6.03066293336503
Encrypted:	false
SSDEEP:	48:Z6XXotX09LRuZobDSP0zkB00VSTo5zKd/67:Z641AAZeSP0AB0lUe/U
MD5:	815C6058CF896AF1DC6CEAE8EC3CBE6B
SHA1:	C914D56121E1FC1432902A6D08FE566F28C3074F
SHA-256:	A7A32698DF665FB51FE1C1AD7CD6FB619E8BBE7C4F787BD1FBDFC6BC9B396B0E
SHA-512:	6D485AF85613C1A12A68FB9C2511D8A56E669F0B379A4CA58302629097AE9FAD47A03825AD88F7725DF518DBD36DF8FFB7967173BE010062F53FA29D6EDD7095
Malicious:	false
Preview:	..5.S.Uu]..bax.l...jA4em.X.%..`.........b.<.P<C1..r.b.cr&.i.U....Q<..<3).....vdnW.J.(....=......8,..{a...R..{-H.u..B\|2E; .-G".d.h.`....[. ..3..HE...C.O..>........(.r.E..%.&7E.~Q""@Xc...B...f?u=K.).N..l.`./.:..{....0.bc.....2.$. I.O.JMB)R.0C}0....O2..k.\U`.G...H.Za!...;.L....A.Z..mg...[...8i<8..k%.._...)TA..g...~\|...x.Zi\.z.....3......S..{....]..o..h.P..N..n.=..#3.....$.K.g8U...-.Hf.M:......$...w..a.$B....N.....N..c....u......LFQZc`..g..I&...s.E..1..b......."....p.ht.X....^T...7...'.........C:.\|..---8+8*---2fce8ef0cf9d0d99ef3f4bc44b5d4f60666b7d2109b4b7067da003e519c87cf3a9f04a472ed27d238f1b1dc7020c11719fd01ff4133f62609bb7b65332e428810d0069cd93ee9e5dd40d5efa1893df305ea35ae4caa71d17829004a76a11c28e83be955f3ec00a8a1619e830d9f19768a984eb2853552a30102d1d2fc5edb8328481e8a41866b2b0d43e1848e3c3da65c972886e775fda902cf8fc67ed5fdc97b3df755a2bbade18e1451fb22994286739f4dbddf926ed9055466389a2afeb11eb950aea6ad0adbe61b71c14de28e111799af7508238396ace62b8954f98352859bebb0620757

C:\Users\user\AppData\Local\Temp\8138487229.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	6.0253106225856685
Encrypted:	false
SSDEEP:	48:Z6SLmyLwwT85TbDSP0zkB00VSTo5zKd/67:Z7T05zSP0AB0lUe/U
MD5:	87AC4FB6F31BF239598FF436C884846D
SHA1:	D37BA7DFDC059160434CC4EC96904024E47EF6A8
SHA-256:	193E742A02B17ADD23AB243123BDFCD345A7C58AAF29F50934D9101118409011
SHA-512:	8A536CB8DC2C6F9505F38138038F8DF9370A5643179117E0DB04AF8F93249E50CB8A93C10DDFBA9F2FB09ADF4B266893124BED461F0CD51021DF73D732008EE6
Malicious:	false
Preview:	..5.S.Uu]..bax...U.Pz...v.>\|.z..)..jCh}8D0......n)......@E]~.c.\...`.WB..S...........8.....ET.^.....&.C{...Y...K....,9R/X...s......v}.".l._!.A <.].!..b.M..g..y....}..Ea...L.x...\3b:.#..I.T.!4....&$.m..?....Z.br....2xx..,...@..>.v..id.t+.D..,..L..b..2.>........d.KnvG8...2vF........kYD.....6........i>....5.6....z.....z.-.4......Sq.@b.p...z_..4."O.0E..;N!.vM..\.wo..?YmE.l<..i^........'.31f.....{Q..(Y..d.]..;.4.7.5.Jf2X?\+p..@..bB.v.>n...8 ...DZJ.....zi......Sl.W..........-....R\.....ri.cf..TQ---8+8---2fce8ef0cf9d0d99ef3f4bc44b5d4f60666b7d2109b4b7067da003e519c87cf3a9f04a472ed27d238f1b1dc7020c11719fd01ff4133f62609bb7b65332e428810d0069cd93ee9e5dd40d5efa1893df305ea35ae4caa71d17829004a76a11c28e83be955f3ec00a8a1619e830d9f19768a984eb2853552a30102d1d2fc5edb8328481e8a41866b2b0d43e1848e3c3da65c972886e775fda902cf8fc67ed5fdc97b3df755a2bbade18e1451fb22994286739f4dbddf926ed9055466389a2afeb11eb950aea6ad0adbe61b71c14de28e111799af7508238396ace62b8954f98352859bebb0620757

C:\Users\user\AppData\Local\Temp\8300215382.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	6.061398687530058
Encrypted:	false
SSDEEP:	24:Z6Ji9WeFe3vqynFbD+BPn0emA5Rb0BuVeFTcrdBwCtxbGMyew/67:Z6JoZFSqyFbDSP0zkB00VSTo5zKd/67
MD5:	4A5708E061A225562D007B0A428B7C23
SHA1:	095E508CCD31EF0926BFC6D9A3723FB4EDCF8E63
SHA-256:	8E18C310C450DE0DD646FEFAB7FB30909EE1727E7567F346AD6377E36C549286
SHA-512:	9582BCC4548E6E834F77F13461B865AB20D24C6B36F954BC587168162308E9EDCCF53CCB0C4A3AC7C55DBFFBC4BA17AC00AC83224541C390C266D44E177440E6
Malicious:	false
Preview:	..5.S.Uu]..bax...:.r.~.1.&Ye..bx.j.4..1..$L...>.-.....-...m..=.R......p...+.....A.[s..+X.:P4..R....%.?P.Lt....TYou.T................S+M........l..nf]...rE....#.;31..v..r..........5.)H\@\WM..#............~.n-B..(E^BINK.....Bz.y.%.N`S..o....03....=...y[0...P.c....t.H.UR`J.m!..m...t..q-(<....jM........NWv...);.$..Z.xF..j..........o-.?L~.y6..O5..>..Y#..C."?>_..;g e..."E.y....<.'/$.<.Y..e.....!.1+./dyAd...-r....Ub.q..=.....vx.T...w.].....#...0.g0.x.....:...E.i..\|......2..l...J..B.,.Q....'L.....x.$..---8+8*---2fce8ef0cf9d0d99ef3f4bc44b5d4f60666b7d2109b4b7067da003e519c87cf3a9f04a472ed27d238f1b1dc7020c11719fd01ff4133f62609bb7b65332e428810d0069cd93ee9e5dd40d5efa1893df305ea35ae4caa71d17829004a76a11c28e83be955f3ec00a8a1619e830d9f19768a984eb2853552a30102d1d2fc5edb8328481e8a41866b2b0d43e1848e3c3da65c972886e775fda902cf8fc67ed5fdc97b3df755a2bbade18e1451fb22994286739f4dbddf926ed9055466389a2afeb11eb950aea6ad0adbe61b71c14de28e111799af7508238396ace62b8954f98352859bebb0620757

C:\Users\user\AppData\Local\Temp\8416181845.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	6.000285258128071
Encrypted:	false
SSDEEP:	48:Z6yPulWvi01vUbDSP0zkB00VSTo5zKd/67:ZiUiyqSP0AB0lUe/U
MD5:	C9E6D7C6ECA1FA385223C9C1C0B7A14D
SHA1:	5DC1407B2879DBE0F737CD78CAB07C740936CD36
SHA-256:	D2A2157E83D1536BB44022E07846FD46BA7E1300E8F18932F75336F77B6F57EB
SHA-512:	54B70D8D9AE40974B876350596C1565363726467F0A0C74E0C77338D3217F975087A90625C6B0BDB2CE3010BE0A2422BE8578CDFCB8388E87FCFD4F233CFAEA2
Malicious:	false
Preview:	..5.S.Uu]..bax.b..TE"J_.t/"...!..X.0".L-.2.....S`..L...xXan1V:.;..k..J...A...<..."Zl.:..EG.....$....(..a..c...-.._1....s.-.&W.SC?;3?.....~b.[....eO.9v.~I.di ...]dL_y.."Y9....V.......%...D.t........&FN+....85Pft....A.........D\%F.Yo.3.>uA..4e..........-..m...D......B.<..6fpvNc..l.....6E...e.s,......jL].j.yt(.....F..Y.S!...;G%7.R.D\.........E.?.(......--....X6..i..#a.Go.)/...G.!..W..f.........JS>u..4.f.kH....;........^z.nbA.x..E8..3.....S..^.k........Qo."......$.."4.[.EH..n.....w-{.v..7Z.3..---8+8*---2fce8ef0cf9d0d99ef3f4bc44b5d4f60666b7d2109b4b7067da003e519c87cf3a9f04a472ed27d238f1b1dc7020c11719fd01ff4133f62609bb7b65332e428810d0069cd93ee9e5dd40d5efa1893df305ea35ae4caa71d17829004a76a11c28e83be955f3ec00a8a1619e830d9f19768a984eb2853552a30102d1d2fc5edb8328481e8a41866b2b0d43e1848e3c3da65c972886e775fda902cf8fc67ed5fdc97b3df755a2bbade18e1451fb22994286739f4dbddf926ed9055466389a2afeb11eb950aea6ad0adbe61b71c14de28e111799af7508238396ace62b8954f98352859bebb0620757

C:\Users\user\AppData\Local\Temp\8416751812.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	6.0459924340102535
Encrypted:	false
SSDEEP:	48:Z6D8TIqMRNVgX5k+8bbDSP0zkB00VSTo5zKd/67:ZS8TIqCNA2VSP0AB0lUe/U
MD5:	BB983BF2B1F2FB99148B3C9D2F976F86
SHA1:	711D4283A1A6CDD8D309E9199AAE2FB8116AE336
SHA-256:	BE73AF1107BE12C2380C7B195DEB2E97AC70C4D23751990BC5CACDE618A701FE
SHA-512:	936D0D4253A67368FF495BBB6C562FFD6E5448EFA251659630F6C06E15E87663E3E183AC9076B3CF9CD52E94571379D11DED1F75EDD6BCAD3E1E5CCDEC09DDA7
Malicious:	false
Preview:	..5.S.Uu]..bax....)....#... ...~....:....r.]H.1i.....Crj.......I..$..M....s...3...."....0$....k.CE_....,..H.T.../2..,v.Je.+v..H.A.0.w..yW]...S...../...7?....T...z..,6...8....1.a.2.(..rD.9.FS.@ .%F...UE.ON..nP..a{1X..OZ..m/u..t. ..S...{..N@.#c..xc&....^H)..S-.H..)i......+..+.TM.....sFE..^..,..W...wG\|.C..$`f..._._0..w.2.......\V.......>(...tW......iQ...L..S...7..L+n.]w.......M...!.....I.hW.C...q....Sw..t%7.....K6._.u.N.!.....eY.T....aG#.....>..p.o.3...\`f......+.Q...}.....y....E..h...L........v---8+8---2fce8ef0cf9d0d99ef3f4bc44b5d4f60666b7d2109b4b7067da003e519c87cf3a9f04a472ed27d238f1b1dc7020c11719fd01ff4133f62609bb7b65332e428810d0069cd93ee9e5dd40d5efa1893df305ea35ae4caa71d17829004a76a11c28e83be955f3ec00a8a1619e830d9f19768a984eb2853552a30102d1d2fc5edb8328481e8a41866b2b0d43e1848e3c3da65c972886e775fda902cf8fc67ed5fdc97b3df755a2bbade18e1451fb22994286739f4dbddf926ed9055466389a2afeb11eb950aea6ad0adbe61b71c14de28e111799af7508238396ace62b8954f98352859bebb0620757

C:\Users\user\AppData\Local\Temp\8492240360.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	5.982531619686334
Encrypted:	false
SSDEEP:	48:Z6jhEkE2eq96sbDSP0zkB00VSTo5zKd/67:ZGEkE2VSP0AB0lUe/U
MD5:	A5DFD20E2D3A45C8F57D0E2F0127DAEB
SHA1:	9E22C47BBBB5E195A565A4DCA358B16F32B12C93
SHA-256:	789F364F188870B3BF53E30D7641DA4ADDB43125291F6714351ECF560972B358
SHA-512:	4A770C5505465B20CF5360A159AD2997CE6AA347D7710F11F3A3549F600168F78B9BE23B861FDA4F7AE09E1CBA9FCB3A31CBA0D447EF27DE33AFA623297EC38C
Malicious:	false
Preview:	..5.S.Uu]..bax.5...G.F..].....Z_..a....[TA4M.a.L..N..v.~..P.w..h.J...f....f.b....F....'.....7F.'....n.........d...VH}La...zc.4..".....r..C..._..)7W....&I=:.IK.$.\.0..zT.iM.....M..E@.]D...Q<.W.z..0.R.+..)y......o.....@.L..i.........O.A....A...'....15..]..c..8...[.fa..#.r....%1?3.[.V..CS..M\|..u....h6..1.....g..21....%Xr.=BK../d.......@....M....H6..L...s1Y+I..673..p.T.......y.h......$(.........@9.n\...Ry..J..I..H.$b.,Mb.;...7ig..3.-4.k.C..A..).9.7._......Dm.0..9..I.gTZ(7.0.G........\......./.---8+8---2fce8ef0cf9d0d99ef3f4bc44b5d4f60666b7d2109b4b7067da003e519c87cf3a9f04a472ed27d238f1b1dc7020c11719fd01ff4133f62609bb7b65332e428810d0069cd93ee9e5dd40d5efa1893df305ea35ae4caa71d17829004a76a11c28e83be955f3ec00a8a1619e830d9f19768a984eb2853552a30102d1d2fc5edb8328481e8a41866b2b0d43e1848e3c3da65c972886e775fda902cf8fc67ed5fdc97b3df755a2bbade18e1451fb22994286739f4dbddf926ed9055466389a2afeb11eb950aea6ad0adbe61b71c14de28e111799af7508238396ace62b8954f98352859bebb0620757

C:\Users\user\AppData\Local\Temp\8784112376.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.035695379574925
Encrypted:	false
SSDEEP:	48:nFNA5Xlpg+kIZwIFwFNrW2v6XDx+jA5fDbQO7iya3:nF264ZhFgg2UDx+j+7iya3
MD5:	C8BB78745F96E7140F0C80920C3CE698
SHA1:	3E1DC82746B896A7F7F436971F16879C05EA6A89
SHA-256:	59677157FBD332829ECAE449DF40535B1B7D552B3844B77FE7C488C1CFDC0747
SHA-512:	84761AAAF9D7D9FCB56FAB00814C515BE24F1C45C832A8606342D5C4276BB895C0862B1E8D31C53A57D27916C053AF8DC57586A4F0AC96BC11836B165385D93B
Malicious:	false
Preview:	..CzFZ...._.3..<B....x.4c....g.X1H..s7.....E...g;EI.....U...._...o...2......T.$kx.M.s.i.p.W.f.......%....&o..GJ........w.".\|@.v....7.R.s...........9v7.>.........=..8........D...d...r.Ht]/..ed.g..DF..\|.?AN.\|....H..c.Q..E..PK..l...U.......G.../.3....r>.s.....;..v....6/P^....E.F....Y....J.....T...(]....58....q..C.i.G-.Z]X._B........n.K.).~G.h....V..Jr...e...c...[.".p...w.r.L.mC.A.S..4....f...#.?e@.;..fzT..<...C....,`......nX.........\|....V.u_.,.%..O....r.~.F.5~.#.i.....(1..e.mXyS.10.8.j.....o.......S.---8+8*---9768a9cf4884ede546472cea29406d5d696dc3b76ab923df69bbfdeeb883c6e8223076c2357fd5891d68348893daf386619f2c9c26daf84181ec040d9ff47df79f232eac09ef7cc8c6256bd5e47c4eb9a47b424ec177267df609db313a0b9fb68a1740d98f56e7f3fcfe8370e3d897784fb8074b5df2897dd65230e53c309089dcf5280e36ade45897ca9419a822592e9fd886bdd5144318efcc8eaad6ab6926480505429aff42d01bb6f0ad153b66e57565ab9fe6e55ef66984c176ec703e8805c951cb40ab8ca57541b7a37253839bc6a7b8e5ee3710e76876a8a6b42f0d9b389eac73d9c26

C:\Users\user\AppData\Local\Temp\8878498721.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.04901781754604
Encrypted:	false
SSDEEP:	24:nkqYGcIeLQAQ388mrXfXWok0R9n6XrXx+jAAUf5+hYwGj3KPHTO7G3q3SplYiga3:nQTLQ4rXfW2v6XDx+jA5fDbQO7iya3
MD5:	B48D6332F47FDE5C2EBDF7A8AB71982D
SHA1:	3D76D9307B641FAD8139411D22F4721AD71F446E
SHA-256:	979AE3EF8D3F313B740C215FB1F06F6499151C0AE53E1F56F4FFD69714A73F8C
SHA-512:	87F1DA4E5AE5FEFE7B32F6084477556D14E41CA93445CFA31D03593B7F28E57D9C2C94D844FD7978A8E825C0F3341BBFD32FC1B2B9C692EE727E45032F6E9F00
Malicious:	false
Preview:	..CzFZ...._.3....../...i'.l.V........d.c0..OI?.H3.O...9...."..V(YT._"=.g...'Y...&.m...p..J....&H.?.....R.>r..d....dA....O.e^..x...9....~..I.x.S6..$.e...qz..N..Og7.z.....g.3.U.6Z...".....a..R.6......F.~'....y.).N..+v..QU,..N..t(.pw.f.:...J.....,D.....-........:..k.4..Gi...V........\..GO.U..8$=.j..h/......\|a..8.......'.H...u..-\|.../.......!j..n?...........r..X.`.H.?Rd]....ps8.E7.mW.....'o......>n_.C....F]y.T.pd....#.[.@..F...........+.\|uJ...<...a..@Z>.RL..3k. l.K..\2..k...:.C? .DH+8.}....4....."../.:.}W...---8+8---9768a9cf4884ede546472cea29406d5d696dc3b76ab923df69bbfdeeb883c6e8223076c2357fd5891d68348893daf386619f2c9c26daf84181ec040d9ff47df79f232eac09ef7cc8c6256bd5e47c4eb9a47b424ec177267df609db313a0b9fb68a1740d98f56e7f3fcfe8370e3d897784fb8074b5df2897dd65230e53c309089dcf5280e36ade45897ca9419a822592e9fd886bdd5144318efcc8eaad6ab6926480505429aff42d01bb6f0ad153b66e57565ab9fe6e55ef66984c176ec703e8805c951cb40ab8ca57541b7a37253839bc6a7b8e5ee3710e76876a8a6b42f0d9b389eac73d9c26

C:\Users\user\AppData\Local\Temp\8886835349.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.05740324011002
Encrypted:	false
SSDEEP:	48:nzBwREBAsALlW2v6XDx+jA5fDbQO7iya3:nVwRED2UDx+j+7iya3
MD5:	38F413E7C0E26A767FACD36997B40203
SHA1:	5F87C90E1E64BB250E2A227F5A1635C6366B0B2C
SHA-256:	25B7F57F9EB1CA158147B11E0857C13FC6B939E317F1932C597535CD0EE6A77F
SHA-512:	20D785826E549BF13A393A74BCD14FC8A6E3A624E9D652DF8DA472BE63EB1BE2B91BA807396CE50F3EDEFE70FAA1B3C3B44C3ABF75FC8B9B696FA594778CE9D2
Malicious:	false
Preview:	..CzFZ...._.3..4..1z'..a..z7...._.Q.\|....E....&i.C...3.8N..=....=.U..A^[./`Q....0..g....T>....0MLZ......f8..........0.=.M.\t..M.g.....s33.J....%G....$.D.?.:..+B..Z(Fs.... .H.A^..+..Bm.<D....WJ....}q........b.G0..e..4.......9..J......].....uE...nw.E.......W..+...V...}.`.g.E....~....w\.....#.l..Q.~...W1...q..w..Fx.d...b....t...G.#"D...]J.....~..3\...EK.\....g.akT.a..V..k......@.......y.s../....V.S<<<.......'.#.W..:T'>.:.Cxjo....0.}.['...'.L"~.......f..\|..WBK9.......:......9....j.N.]>`T.i,..\..Z._..---8+8---9768a9cf4884ede546472cea29406d5d696dc3b76ab923df69bbfdeeb883c6e8223076c2357fd5891d68348893daf386619f2c9c26daf84181ec040d9ff47df79f232eac09ef7cc8c6256bd5e47c4eb9a47b424ec177267df609db313a0b9fb68a1740d98f56e7f3fcfe8370e3d897784fb8074b5df2897dd65230e53c309089dcf5280e36ade45897ca9419a822592e9fd886bdd5144318efcc8eaad6ab6926480505429aff42d01bb6f0ad153b66e57565ab9fe6e55ef66984c176ec703e8805c951cb40ab8ca57541b7a37253839bc6a7b8e5ee3710e76876a8a6b42f0d9b389eac73d9c26

C:\Users\user\AppData\Local\Temp\8995528179.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.0269695170937325
Encrypted:	false
SSDEEP:	48:nL2oXb4yhWoEBbkpLmN1W2v6XDx+jA5fDbQO7iya3:nLJXhhWBBopLmNE2UDx+j+7iya3
MD5:	199F1B05ADCDCA0D335E433B56D1AC95
SHA1:	900937400194525C1AA7C8723E667B8B44692EC5
SHA-256:	16B105758F241B7EE7372D0C12080E6B3941D7733D33A6F03FB6BA65B29BCE81
SHA-512:	762A38D90410E49FBFC724C0B5431CC034C93C9937E24C395B555559BBBAF06F59FD966BA5C691E1F536B31BA56E5B7D80A4BE51F837EB83C2C771241AE5EF61
Malicious:	false
Preview:	..CzFZ...._.3....9>..R. ...n4TIz\|?9c.J\..l..E.m$.'...zt.........R..2....lc.....G..Y.k....O.K+.2p..j.............h...]lwO0.YYJ.....(..%..$..........NS.w....6(u...MA...C.`.A..C. ..ini\..@c..R..{,..0.f.......)..R...........E...n.@..&d..Y.y.&[.........nl.M&.I.B/Jux......Qi..[+F.n..BM[.S.l.X.;A..HC).IJ..G..dM...-......f.JS..f...N......~.J.8...6_W.Gi...i.".!)!.k"U,...6S..2;ci.-.a.0.[.S.5.f..^.7y.............J.\|...K+2K...\|wS...8ev.!=.T....X...&]6.'.~.J.u.u.s.;l...q......6..R.OQ...J..-F..{b..<....2....g"...Q.F---8+8---9768a9cf4884ede546472cea29406d5d696dc3b76ab923df69bbfdeeb883c6e8223076c2357fd5891d68348893daf386619f2c9c26daf84181ec040d9ff47df79f232eac09ef7cc8c6256bd5e47c4eb9a47b424ec177267df609db313a0b9fb68a1740d98f56e7f3fcfe8370e3d897784fb8074b5df2897dd65230e53c309089dcf5280e36ade45897ca9419a822592e9fd886bdd5144318efcc8eaad6ab6926480505429aff42d01bb6f0ad153b66e57565ab9fe6e55ef66984c176ec703e8805c951cb40ab8ca57541b7a37253839bc6a7b8e5ee3710e76876a8a6b42f0d9b389eac73d9c26

C:\Users\user\AppData\Local\Temp\9106464316.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.029897304962531
Encrypted:	false
SSDEEP:	48:nvDbQ2Oa7sH+2GW2v6XDx+jA5fDbQO7iya3:nvYOgH+2P2UDx+j+7iya3
MD5:	D6D08DB8E659C4B5D29CD10A7E80BDAB
SHA1:	CEE4198CEBEB114A694622A53AE7E79147AF5481
SHA-256:	8F4FCEA4475E7C737F48EFEBEAAF6CBECC92A7073DAE0412A88E63019D904A18
SHA-512:	77ECDBEA0D975F658EE144AD30B077B11CDF964DC0C72AB862C54A16AF7E096F1EB7108E1ECDBA20D8C007622FC9DA590AC27D6D62C0B44D9F6AB8B129373432
Malicious:	false
Preview:	..CzFZ...._.3...B...5...... C..I~.7.z..R....r4.........q&,.P.b4!.U..[c.z.....!~o.U...U..V....."..4L.M......\|...f(.T^E........C..9.vfp.p.l.S..X....s....%V..G.....^....~.BZ....A;\|....>L..)....}.F}~.h..._<$nk...mnb.....l....a8-M...d....Y...4f9ANtX@..(,..T...K.....%.....;.K..n&s=`G.g.m....9......2..qB.\|\|...twl.].-......k z.b..K.{v....Q'.:.....(.A...~]-.\....~+d"..W+.K..zZqQ..{.&. D..t.....,..%-\`V.8i....}G..p2i."...-`8..1h=>!....h.....!...%b.o.....n..y.K..S..e.a..0g.g..r.....:.53.....u1...V..!Q..s..---8+8---9768a9cf4884ede546472cea29406d5d696dc3b76ab923df69bbfdeeb883c6e8223076c2357fd5891d68348893daf386619f2c9c26daf84181ec040d9ff47df79f232eac09ef7cc8c6256bd5e47c4eb9a47b424ec177267df609db313a0b9fb68a1740d98f56e7f3fcfe8370e3d897784fb8074b5df2897dd65230e53c309089dcf5280e36ade45897ca9419a822592e9fd886bdd5144318efcc8eaad6ab6926480505429aff42d01bb6f0ad153b66e57565ab9fe6e55ef66984c176ec703e8805c951cb40ab8ca57541b7a37253839bc6a7b8e5ee3710e76876a8a6b42f0d9b389eac73d9c26

C:\Users\user\AppData\Local\Temp\9275373402.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.032362101983871
Encrypted:	false
SSDEEP:	48:ngl/lQtzFx3vh7W2v6XDx+jA5fDbQO7iya3:n0/sLvE2UDx+j+7iya3
MD5:	2950EFFBC3F0E641B33E0806D8DBAC34
SHA1:	E202A4C51EE3C4F145ABF7B18CBAE0E006B88E31
SHA-256:	4C4B49B677ED4B79E273A8B0D78DC40393ABFC93ADF0A728712C880B5417FADC
SHA-512:	A5FC86B14FC24EB6802419DEE2D3BB3F316804E680E46B2DBB51D52CBB3976466E1E278D30509F514218099828AAF822308B3409878F077571DCEBFB85CBEA6E
Malicious:	false
Preview:	..CzFZ...._.3...b;<=.](.).@....i$"...........U>...;p.bB.rq..J%H.b/....^<.C....r.......}B...}..,&.t:..X...Sjg..3.y.$..m..{'uf..$C./.I.@.1.YyS=&..NF.G...C.Z..f..$i.ZM['.6.m.2.KEJ....i'.....\|.z.........[.i..<...M.;....gk.H.....(.8I9.KM:o..4.m(j.K..G.....y.N.m.z"W.N#P{.Jc.V.(..j.....f......).s...~L..F...f&KX/...Y.a0s....N-%...s..i(....#...F.lf.7.>N]4E=............Z.!c..-..?...1...Zv"<.....fv...}.2...X:...c..>....M..t....c..I....&[Ny.'G...=....;.I.z..xeW......4.'X.#lv......K.5...>..,uS.@...o.1....C.F..a%....---8+8*---9768a9cf4884ede546472cea29406d5d696dc3b76ab923df69bbfdeeb883c6e8223076c2357fd5891d68348893daf386619f2c9c26daf84181ec040d9ff47df79f232eac09ef7cc8c6256bd5e47c4eb9a47b424ec177267df609db313a0b9fb68a1740d98f56e7f3fcfe8370e3d897784fb8074b5df2897dd65230e53c309089dcf5280e36ade45897ca9419a822592e9fd886bdd5144318efcc8eaad6ab6926480505429aff42d01bb6f0ad153b66e57565ab9fe6e55ef66984c176ec703e8805c951cb40ab8ca57541b7a37253839bc6a7b8e5ee3710e76876a8a6b42f0d9b389eac73d9c26

C:\Users\user\AppData\Local\Temp\9281004682.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.052431798407774
Encrypted:	false
SSDEEP:	48:nvZfahOdDfjNMW2v6XDx+jA5fDbQO7iya3:nvZf0Yjj2UDx+j+7iya3
MD5:	43A9475B5968463559AEA11A70E5AF60
SHA1:	9694852170D38995A4CCF6098F6FCBEE41DA7977
SHA-256:	7BEC97210DC1FE6896F648E76573C7A69FEF9ABB2E9DE132BCDA067583D4CD0F
SHA-512:	543D5C7AD3C22283CF3D6E62EF63723D765BCA5D7A9A15A03773DCC628402E7EB62A2E812C9E920DF646914EAA194096005780051D2617C0FE7359EB60EAC81A
Malicious:	false
Preview:	..CzFZ...._.3.......l..U..>...+...A..5.........E?..........Y..!...8.h.7n`.y.x.d.\|..B......ak..@..'.l.q....5NP..;...........[.AQp.\.....n.J...rf#..7^A..J..f.1...8....P....G.].~t?.G... o.F<...Vh...../T...E.Ut..t,...i.o.n.{..J.6.1....].....KU .(...#..5..>..gi..b......G...a...,.CG..3.............>..9g.......R..E.d>C....Q.i...!<R#.)..dPl(......^!m{..m.._6.p.V...;~........I..o.f.3.l.<)3]..(..&..q..zN.>...$.......B1..%.M#..A.....&......a..w....cT..K_.^:.Q{{..i/6..q..p.K...J.X./d\..a(.....<....cvAN---8+8*---9768a9cf4884ede546472cea29406d5d696dc3b76ab923df69bbfdeeb883c6e8223076c2357fd5891d68348893daf386619f2c9c26daf84181ec040d9ff47df79f232eac09ef7cc8c6256bd5e47c4eb9a47b424ec177267df609db313a0b9fb68a1740d98f56e7f3fcfe8370e3d897784fb8074b5df2897dd65230e53c309089dcf5280e36ade45897ca9419a822592e9fd886bdd5144318efcc8eaad6ab6926480505429aff42d01bb6f0ad153b66e57565ab9fe6e55ef66984c176ec703e8805c951cb40ab8ca57541b7a37253839bc6a7b8e5ee3710e76876a8a6b42f0d9b389eac73d9c26

C:\Users\user\AppData\Local\Temp\9369051781.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.042474047224887
Encrypted:	false
SSDEEP:	48:nLelHrcoOpBVW2v6XDx+jA5fDbQO7iya3:nLELek2UDx+j+7iya3
MD5:	591248A69E73A804E6CC426085171A09
SHA1:	397BD01431975929AB1F7D26369E1FF060A4C769
SHA-256:	45DAB21FE940A385C9BC4A30714D4B07D9B10972B397C690069A58408B48A0C7
SHA-512:	DF7BCDE478EC874E63B3F3AC37D5890EDB088EA22F932D3F39438A509634FD23B0E4488B81EF0105D1F5E28B40CF04AEAFAD21E9D851971CCC7BA1F19E2B32A2
Malicious:	false
Preview:	..CzFZ...._.3..W.......Q..Udd...B.w<....]..J...1D+..?K..c.....nS..y..>...x...r.4..vb.........Y;}.k..JA-..k......8...6.s./xpY..Q..R.[.Y......#_...#1tteIb.9w.hI...p...)..pX.3.m.X.BH.G.......k.....`......4o....I.w5...N?x..;..\|i...-..G..W$.>..to....?A.. .'/G..^@.#......_....;+@...A....K..r.a..G0$!w.`:........&%......p.6..Jy....#..3d..9...4.H.#`.]...V.P......z.@t$....>....~...6...~..B....R.....9.VQ.ZZT...(^."F......P....g...$zmYi...M..'7.a..3..c.Sg...}....h1....G.L.1..o.z.&/\|C.}.6(....n..7...Da---8+8---9768a9cf4884ede546472cea29406d5d696dc3b76ab923df69bbfdeeb883c6e8223076c2357fd5891d68348893daf386619f2c9c26daf84181ec040d9ff47df79f232eac09ef7cc8c6256bd5e47c4eb9a47b424ec177267df609db313a0b9fb68a1740d98f56e7f3fcfe8370e3d897784fb8074b5df2897dd65230e53c309089dcf5280e36ade45897ca9419a822592e9fd886bdd5144318efcc8eaad6ab6926480505429aff42d01bb6f0ad153b66e57565ab9fe6e55ef66984c176ec703e8805c951cb40ab8ca57541b7a37253839bc6a7b8e5ee3710e76876a8a6b42f0d9b389eac73d9c26

C:\Users\user\AppData\Local\Temp\9607816641.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.029682237969229
Encrypted:	false
SSDEEP:	48:nW09KnWma/BAW2v6XDx+jA5fDbQO7iya3:nW0kWmaZZ2UDx+j+7iya3
MD5:	63AC28CAA68BC5393DBE49F83FE7BD7B
SHA1:	7649EB8CE1BAA87E165F3E4C572497B642A062A9
SHA-256:	51DBD162A8672FB5F3C166477D4BA5A6FB54CCAB9E6B5B6D6F614BA171DF62BD
SHA-512:	6CBCDBB06013888C6D7C22B0147711B814821C0D3A34F54395FE6C4863F859321465B1D9D13A7BBAE31ABCE48A01F5CE3CCC2B76326ABBAE41BAE6BC39FADB33
Malicious:	false
Preview:	..CzFZ...._.3....A..G.X(].tb........m2.n.........b.n.C<.a..[.r.5..{P.`...g....B...P..=......\Ys.\|.."0..&&+"[}...w..oBd>..u...e...!......,.........m<b..t. O~{..<.yH.?....n@J..O.L...a["...\......o{8.Wfn....O..........u.j}A..q#m..2..M.G.....t.m.....0...n$$.~.!Z.7.._O.Ws..5..V...$.....$,1o.... .....J.4..B....... gY...-......Jn..M!.@j. ..,...p...V...x.).....98.4.y.g.~.x^r+.......".EOg......%g\...P.......I.q..3{...8.m.n...[..I<..w.@V.......2\.K.........9....#..j~..../..vJf?j1..0.?z..s...g<....<.y>---8+8*---9768a9cf4884ede546472cea29406d5d696dc3b76ab923df69bbfdeeb883c6e8223076c2357fd5891d68348893daf386619f2c9c26daf84181ec040d9ff47df79f232eac09ef7cc8c6256bd5e47c4eb9a47b424ec177267df609db313a0b9fb68a1740d98f56e7f3fcfe8370e3d897784fb8074b5df2897dd65230e53c309089dcf5280e36ade45897ca9419a822592e9fd886bdd5144318efcc8eaad6ab6926480505429aff42d01bb6f0ad153b66e57565ab9fe6e55ef66984c176ec703e8805c951cb40ab8ca57541b7a37253839bc6a7b8e5ee3710e76876a8a6b42f0d9b389eac73d9c26

C:\Users\user\AppData\Local\Temp\9655434068.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.028552359476688
Encrypted:	false
SSDEEP:	24:nkHehMgk3FKVnwwcDSrwjpLsBdWUETc6MXWok0R9n6XrXx+jAAUf5+hYwGj3KPH5:njm3MUjOtW2v6XDx+jA5fDbQO7iya3
MD5:	2FD6C7C589080BD36533BD424ADBEB70
SHA1:	2D56B21BDF0521B81DE0FDB4EC933262DAD58F6E
SHA-256:	C6AC4146B536A11606FBE945DDD67CC1E233C32AA1EA0B21DC3307F13CAE6EFE
SHA-512:	77B7B3D4B1B29728665FD6EA247C2DB800FD5CF25E24D0987633ECADBC1D173A743A25692B20FF0531D65389FC8A5090039CCE1CD95E91CC2A5E77046E4E89D7
Malicious:	false
Preview:	..CzFZ...._.3...D}W..D.u6."..^...X>B}....,..<..yO...w...R...TB......T...T...j.LFv.).V#CU^.x..O....U..z..hm......W..\|F[3.C"..$.R`...GU...kp....t}k...{.Li^.-..eUfN.....Y./....D..O.9.bJ8.-"z.L....OB.......W.la..1n.P.OXa..#n#.>&Cl~7..y...kR.V...!........j.Z.,.^i.0~'..W.."=.G(yb.....:G.7..A.^!.n....P..1B\|]...}IP..e.XzCA)....Z..b.KC........../..G.~F.7.zy...".~.........)...C..W...,M.d.R.....Ti.......7(..d...W..S.p6...S<.k/...D0.+...'...6....c...\.C$.>13F"pN.w...\|.C.1.p..t..$....}..j.6.v.{".o.g.L...8.+.>..j.---8+8---9768a9cf4884ede546472cea29406d5d696dc3b76ab923df69bbfdeeb883c6e8223076c2357fd5891d68348893daf386619f2c9c26daf84181ec040d9ff47df79f232eac09ef7cc8c6256bd5e47c4eb9a47b424ec177267df609db313a0b9fb68a1740d98f56e7f3fcfe8370e3d897784fb8074b5df2897dd65230e53c309089dcf5280e36ade45897ca9419a822592e9fd886bdd5144318efcc8eaad6ab6926480505429aff42d01bb6f0ad153b66e57565ab9fe6e55ef66984c176ec703e8805c951cb40ab8ca57541b7a37253839bc6a7b8e5ee3710e76876a8a6b42f0d9b389eac73d9c26

C:\Users\user\AppData\Local\Temp\9713424497.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.034232076026054
Encrypted:	false
SSDEEP:	48:nEKS1VeBzudsgW2v6XDx+jA5fDbQO7iya3:nc1VeByi2UDx+j+7iya3
MD5:	4D0964CF284439C0AA1B872D8C530743
SHA1:	6CDDB0F627E4C7113A894597DC167A304B40F81D
SHA-256:	245EC1E65093AE21A8A978F172345F9A0A9D9A82C42BFBF32F3BB78EB5AFCF62
SHA-512:	68213BA85CBA50037D14C763340F9C41A6F7D7E5088D41C638D22F82BE084E469A84CC06F5F0971BEA82BDA457802794E65BE789CF6B151EEF2783E17A5C764D
Malicious:	false
Preview:	..CzFZ...._.3..#....'F(Hz...z.l...j.n.&m...H....;..N..L.c.v.V.lW5..x.Q..CS......<.uc<}....=.....NC5..;.C...o.U...n....YL....1....z8,e.`..m...~t.....@j........~wv....z..!o...%.+g\i'ln}?.W.30.q...W.Z......]7.D...\|z..c..m.m..F".`....1P}........F%.7...r....y;`wH...3.bf..!....UuB.b.R91B........{?.-.(GO.j.v.V.W.m...\..N.Q.............f..s............^...-..B..../T_.0.^:?..m.){......H.\...y.5...'.D[G.w......R...5g....!m.b..1G..vZ.$.S..!h.lc.8.M..0......qQ.......Q....C...<..B.k....V.-..(d...j4U.x...Mt---8+8*---9768a9cf4884ede546472cea29406d5d696dc3b76ab923df69bbfdeeb883c6e8223076c2357fd5891d68348893daf386619f2c9c26daf84181ec040d9ff47df79f232eac09ef7cc8c6256bd5e47c4eb9a47b424ec177267df609db313a0b9fb68a1740d98f56e7f3fcfe8370e3d897784fb8074b5df2897dd65230e53c309089dcf5280e36ade45897ca9419a822592e9fd886bdd5144318efcc8eaad6ab6926480505429aff42d01bb6f0ad153b66e57565ab9fe6e55ef66984c176ec703e8805c951cb40ab8ca57541b7a37253839bc6a7b8e5ee3710e76876a8a6b42f0d9b389eac73d9c26

C:\Users\user\AppData\Local\Temp\9801086636.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1564
Entropy (8bit):	6.045824422023244
Encrypted:	false
SSDEEP:	48:n2jHgG4G3VJZGI1W2v6XDx+jA5fDbQO7iya3:n2jA5GcIE2UDx+j+7iya3
MD5:	C5A66CC710B06F74D49B7942411700CD
SHA1:	71828727E10186B84415BCBA4E8314B290949A60
SHA-256:	186A10D702C4730C1406250DA5DCC51E95973404CC102CB50B5D5F66238B5B5B
SHA-512:	543598C3712B8E633FBBFFA2BF4EC956FF820BC70116224F850FED538D8ECD6D25F628A0FBC0A74C2D673C539B43E5567BE31A28AE29CDE525BAD2FE7A422017
Malicious:	false
Preview:	..CzFZ...._.3...q..x..=...OB.gY.3.]...;pt...=....b..c..Y........ya.,.....5.8#...+.]....!..^n..0.s.....$..p'..M.....(.>sCiO.0"z.q.Q....R.8..nw#O..r....W...;.....H..,.7.^X..O........L7.".......UmD..J.7..zQG..&..S..IT.Z.0T.n.....D....K..!....8..'r...(..?Zu.M[..;...v....a"....N........1.\|.y.=7z..{,..(G.U\|:~....j..F.2..........%..b`.......l..T....O..@.4..+K.....&..0L..."T.^3$.f.8.....i.k.5..&.[a.r.....B.U0........J.z.\.B.NW;(".f.;...8........z.\|P.D.x%d.......,vEO<A...........>....V...~....P.q.B.g....---8+8---9768a9cf4884ede546472cea29406d5d696dc3b76ab923df69bbfdeeb883c6e8223076c2357fd5891d68348893daf386619f2c9c26daf84181ec040d9ff47df79f232eac09ef7cc8c6256bd5e47c4eb9a47b424ec177267df609db313a0b9fb68a1740d98f56e7f3fcfe8370e3d897784fb8074b5df2897dd65230e53c309089dcf5280e36ade45897ca9419a822592e9fd886bdd5144318efcc8eaad6ab6926480505429aff42d01bb6f0ad153b66e57565ab9fe6e55ef66984c176ec703e8805c951cb40ab8ca57541b7a37253839bc6a7b8e5ee3710e76876a8a6b42f0d9b389eac73d9c26

C:\Users\user\AppData\Local\Temp\AdobeARM.log.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	5334
Entropy (8bit):	6.1990868063310645
Encrypted:	false
SSDEEP:	96:Gm2Q5GXmRc6g2VJp1wjqHH1VI79jHHRSOxyugaOjMHENlRqW16LVbSXTL3R:GmpI69Hp1MYVI7lRTyugaGXlRqy6Lojt
MD5:	D8B7BA36E97B3E106DE863C0307FD709
SHA1:	BB10C161DCF158DF83D7C6824D243430CC88A55C
SHA-256:	158073040C1EC4C3506ED0CC890953CEA70984340BF073016553785F633839C3
SHA-512:	FA90A777F35F9CEA14C9CB1B0678EEA5F187EAB32A5B2562B024A6FB1BFB8F92ABBC9151460B1FBA45282AD9B6782AE53DA1B96CB41A17E1F857CBE74BA68C29
Malicious:	false
Preview:	...W....]....b.../qA..../r.8......\|q......S....D!v...(d.........vX..Q....D.....m.DN...NFv$..3.6..0.,...t_.=...MRr......\...GE'bK.. ......]..&.x..?p%Sz.K..T!..D7.]A..o..k.}....96V...JL.4%.z.. !.3..}.9...`*.RMOJ...V.xs....^......w...t.@n.C../.......k.?Pj......6-Z.d.$>.p...5.hl[.....i.M.e...4.8..^..Z..D.1,..&...a%.^..{..w^..`m`..~)..-b....rl;..?.e.17.....Cq....~.........m...gRD.....S'...f..q.qE.[..V..~...T!../D.s~....[.q....@.f.^m(.?s.1?-....w.`...nkq....JC....B..3.N...t.....[i....L...........f..y.W..2I..D.e..X..@Og@8..5...~GA^.......A1+...q....x2....j#.......6g...[....Q.m.n....'r.>..T....... ..}.W>,..\...5..#../n.p4a.l.....ep:.A.L.1.b}...YJ.4..q....wP..B{.K.m.S.d......H..?.B...".k.Q.;..h.5x..GI..z.=JL....Jl1\|....".....B......./.:.+Y...d.S..r..!.v...cIH..W4'.....Bv.V..H..z.I"LS.D..b...../.%\C..A../...R...F.C......`..1>3C..D.obpl.W.C.k..)....Z....X-.Pu.o...hm..........._.`4KLL.L..v...N.r._qX...........,..(..T.......}.r}.x.....{P.d.F

C:\Users\user\AppData\Local\Temp\DxxAlien_ReadMe.txt

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.051387142798908
Encrypted:	false
SSDEEP:	6:/r8JDlElqxCSfm+1bMvWjEJ2lcImZxDsxC350D2vrhL6A1S2Thm/glad3L3UzNmS:/rIEMze+On4Zi0D2vroAJ1laZBIH0b0n
MD5:	2682F56A557A7C02AA35926B7199A995
SHA1:	DE81D71A9C9101BE613CB9BBB5643F2BD8AC2B32
SHA-256:	3B4B3EBDFE5CB901BE7746D6A43352D1ED1F378A482BA0EFDB17569A681B4BA1
SHA-512:	D9753245CD947DF6FC2D251A3181785F3F934565361F12DF70511DDEEFCDF57317B6BA6153CB1BC7D3A84B60FFCBBB043CE9315B77B0DC0C3C2BCC1D9CD3759A
Malicious:	false
Preview:	Greetings the @world..Your PC is under my control and all your files are encrypted by @Franc_DC and @whitehair_maldev. Please not to do anything. You may lose all your files unexpectedly....Just follow me....Pay COIN to here and send D.M. to above tg users then decryption key will be returned... Best wishes....BTC Address:bc1q9thrny2nfsssj43tg5mzjnthdv2n67lxg3s9lt.Etherum Address:0xc7E856E21cd26AA616Fdf6F232cc42859bEf8952.

C:\Users\user\AppData\Local\Temp\user.bmp.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	603220
Entropy (8bit):	1.6085284295717115
Encrypted:	false
SSDEEP:	1536:M2jmGaRB+HJcBN8QxzJoj0bCmzdblnr6TAw8:M2ypRBxfW0+IdBOu
MD5:	5999FF3FBA4209E1FA437D40E8FB3A9B
SHA1:	BB17AEEEFB9334EEDE2C938D1546160960E5AF17
SHA-256:	B2983FB4267EA03EE240F52369073523970192737E9993FDF96699242303366E
SHA-512:	1022ECDDDC05A829284B5B5EFC1CCE9DECF2D88B2298B216743DB0BDE8AF8CFF6F0672AFBF9C2758A3DDD914EC1DD880E74A9555EEE8953508CDF92D869999B2
Malicious:	false
Preview:	...W....]....b..%.QS..[.v..P...\...]R..<.....3..-.X......".+PcCaF..a.N.........6.....=n...]..,.vlR...A<$W.t..m......vPh..RX.Ux....4..E1../.I#.a......n.+.0H......x<X...gD............r...../..o......I..N...oK....r..~.. ..(5F.Dr.U.b.E.h.7.[.9...&?r...?..VC.F..qsw.......].:....X....5..af.jo......_.....D..}B.L.^.J..!HZ?/<......8.....M@.B.....}...yQ...A....N`.&6.T...=.W..8u....c1.bu.A.....gI/g..h....Q.b.=".k.p.A.8.o......}........)26.[%w'~nT.D.&........7..p.Za...F.(..wx....w...-o.....a.tN..R.k..M3{.."..\|f._b......mAf.H....N......`..!....>.,........($.c%.8]i:.^?....?4B./........$n./.$...t..3g.&;....4.T.N.F."_..]}..(...);9..G.7C..;..L..U.WDa&.x.s 2...Zq..F...N.N..g....VcF.B..<.\|..p..(..(+%.]..b.........&..#.s.j\|~......N....."......q.Y....$.\....B.\.f.7....gHLe[}... ./.....{..f.).c.?.C......WT.sfw.?....w......3sy.-NP....FS...ig.........V9..8...yR`iH....:B..L.;M..n..%g...%R%.L.J. .$.r.Lh....S.P..>?..f`.%.z.J#.})....v.......Y..#...+.....N..B...Q...l.

C:\Users\user\AppData\Local\Temp\chrome.exe.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	141852
Entropy (8bit):	7.0257051247930775
Encrypted:	false
SSDEEP:	3072:49LWA2K+vL5kdnQaWei2uz/Hp518fCaRPF95kT73jaIOr/uHw:mT+SdQNJyCaRPF92vmr/uHw
MD5:	7F3D248CC675FC44760BAA05B4046702
SHA1:	2877F807E34CC425DCA44D30456D98EBABE267E4
SHA-256:	C823E9B8DF139489CB59BBA6A2D9026E697AC6307E6DDA8ABEFD9903B66E0FD9
SHA-512:	E6217A81897A65270B93B5D7EDF2668F72F558BD8E97C2998BD9EAF2805D715FAD190CAC7A0A825F27F91229B434D4054D0F0F3813A27344A923EAEBF732AF7C
Malicious:	false
Preview:	...W....]....b..C..K..t.....m.8.VO.#.IYr.0vS.!O.^".>.....U.(%.Q-..l...0{..Z._5.NI.wpW^...i.....E.......V.].&....4..m?..W......F..D.....B.,.j..k._..P..Q+..?.~.....s/..4..{..8...l...g..k...J..4..L....1I.];...N&..V..l1y....MDq~e....l....4#..K."..LP..=...?.T`G.e.4.u=,.1`.{.~....Q..Ig.@.Qbg...v....A.i]..B.t}9.j..k...).r..}.6P...-.F...m..0..3..!.?&..Fh...m2.Hf....9D..'..y<..6ls.I6T...oJ.......;P.....WY.>........=....1"..BQ..(.../.....)...."}..+h9......Y&LQ..h...a.!.]L....R..9y...ve.-.a..u.`0x(.V.#...~vy......i.f.v.2U:.E.q1..R7..P.q...b...V....$.".3.Omq......B0.`..]....\in...]KdX...Z.x...`.....&&...B.%.....@.dO......vd..`.../7$....x.#.z.. ..M.~.}..........>y,....u..H.....IfM.an.p.N..6_..Y....5....."`...8#3a...4...B..qn......w..7....uES&\oS....B.d0...U.c.^.S...)A....!%.....V}..D...G.#..}=.qX..-nU.!..M..j...A...y.W.[..4.L.b..H...f..m....S.$.1.q-...D...Ym..g....'....m.!.pF.q7.qF.9...K....Q........=>..O.<....!`a.......[i.._u.4.E......k

C:\Users\user\AppData\Local\Temp\cv_debug.log.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	2809
Entropy (8bit):	6.776434132842399
Encrypted:	false
SSDEEP:	48:omm9YDqI/ss5sbWdRKS7b2PVij01eDJk5c1903bj5jJp0gcU854Rro0x6rR9V9V2:QeqmybWdUTQdtc5toYv6LVbSXTL3R
MD5:	AB8775EDFFE59B8B03436684A263FCC7
SHA1:	E68D44D5A02B17F0E0C8400D3202D2EFBAFB3142
SHA-256:	823C0866173B82D7E929F623ED73BD5763C0388E67215735399CCA353CB2BABA
SHA-512:	8C9844C9607BED6B16FA5032467E9C1596C87E65B43269464D4B04AF3A370A72352B836C13487E38C99458C308784E58EEBB5FE2C5CD9CB88A1DB4D55726ED27
Malicious:	false
Preview:	...W....]....b..g.`.{.p..._...4....x.A..".{mJ..M.....H..F>x/,O...dm61..Rf..0..7.f...;.]..>../.+P...e)... ..-,...M.El..u.Y.&.......2.I...P..i....".{X....l.Yj3.R'.H.m~.......D!{.Ll.....f.\|o.7E..f...3K...3...........OD.T.....S....N..p...n....`5:...ql.X..Yg.7.a.i...}...."..(..E..4#..........tr.N....`V..s.O.R./.2)..;._l\|oS..yj..U.#.u..Eg...(D...d.O.Z&.q.......t...eK..{..[Y.#2s.V`N<\|K.~.-..A.U..t6. .u.Y~9/....$......%.T....[5.@.#...v)....V.S.>.=iFD%"....Q}..u....Qy.&b..\|]Jg>.&.....5j.y..9...*qF._{......Ap.eA...t..zb>@.g...>M..........vQ..m`{...(....vO$B..a.i..R...,..-...-.....~5Z....;.#..f.D..b.\|.... .6......#E%...H.Sm....'.X..;n..E.?==..c..VEAD...G.<H.'..IU.3/.Fx.l.D...AJ..Q.?.!.UI.q.......Q.>.?........o.......n].?.....$...u.....\|v.pU.bF.CrQ.8....d}. Q?7...b..k..>..H.........^w....z~...M.G..Q.7{.T.Z...zC.,..@T.!..R....o...2+Y&..'.G..m.I...,P...vE..1r..E....6ql...5.r......M;..H^.g......B...uC..6......).`..Ba.@....f......uM.\!G..n<.x.. a

C:\Users\user\AppData\Local\Temp\dbghelp.dll.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1528540
Entropy (8bit):	6.533103802431723
Encrypted:	false
SSDEEP:	24576:gMe+UHmzqV5zPdW7oGHWKxueHRTr/1S8ey4KphzOHcxDTe/owv51X:1jzq7zMUGHU6/1S8t4K3zp1m5X
MD5:	370D366DF1BFC6735FA33C37D0926A6B
SHA1:	440C6E51685B4FEFA7C5CD84AC1B01F707B5D590
SHA-256:	0A8920F9E61353AC29C2F86BE6C296AC3F591B5F746F8EA4891BA64C6C20B262
SHA-512:	8BE633C7CED6F2E85C57004B23BD52136CAFC36C753B34DB14E0FBC486CCEEB982E627AB1B4A78B88F31C4CA0664D61B2446EB74C58BC08B887FB3FDF8C640A0
Malicious:	false
Preview:	...W....]....b..C..K..t.....m.8.VO.#.IYr.0vS.!O.^".>.....U.(-...:...........#...Y.....=NJ+...xw...Kw.].D........e)Uc.4.F.y.P..lm..T..1.hw...P/.C...a..>.j.k....0}......l...q.V.A.8x..>...N-.....5v.F.0..bd..k..h.,....n.5...w.;..O..F.y..(:.<(....k.l.u..D...{.L.x2..aFw.......\.4H...Y.......u..Z<.c#FI...Ix.z....y...]..akq..9w.Xc...#!.=..1.:.R...'=3.q.S...0h..&.<8.....3<.....m=..../.O.M..p...@...8...M,1,.&6....j.#.(...\D...b.A..q/.F...=.s.,..qqc.90.p......Gj8......e.....R.......}@.M..O....}xB5\.o9.B..(.....K......F..].}.<r....z..Y..{u....8z.s.m...1.L...I.4..!.._..AV&.@,8%juT.X...@...7T.d.3..f./..2Bo..gJ.j ....1J'H.^....o....^E..c.`....iG.......^...q^(.\|.eq......>L..7..4..H.K.y....".Mf.LL.:.J.k.a......-v......K.......n..hKu.a$Ia.nV..P...5$.?~3-.QW......{fv..qBF>w....-pGF2m8D....E....4...+a.j...$F.@...J....s...D..C....8.{^3.)3h.p3.......h.`..G%-.:.....:L..Z...=9.\A.$.)sg1.?d.$...?(.....`He.O[..u...>......6,..N.\6..+..8.^.(...X.!d..

C:\Users\user\AppData\Local\Temp\jones.bmp.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	603220
Entropy (8bit):	1.6090561676615345
Encrypted:	false
SSDEEP:	1536:rMnSj1pRrGI7Jf4KBXABPF/EpBUOSfrb19IuoE5wMnRXgJ:rgShzSI7JQTPF/WAb1qTM5G
MD5:	7D7FA890DCE1C95FA8B400AD5E175BC6
SHA1:	3FECDACBCEB626A5729208312EC929FD5AFD0EBF
SHA-256:	A7A677588AEDA86246476FC75E2D2BA1CE332C75597DC2E6B02D3542C0A3D867
SHA-512:	C94448779B97414F141FFC46500F68AC5EEBF720266CB0F1E2BEA1C85B3D38BEE6FA04A4FAC73F2F2EEB0F053FEE02E798C736A980AB1C4AC7BF06EAB2DC72BD
Malicious:	false
Preview:	..l...(.^.....~>.a.Ju<....t..I......^I.U...@.e...w.!.:...}..n.E.X..A...s%5.....u\|T..{=....O~...o.9....O.n..9..>.......)...b.d....!...@.d..(.......^.W\.=G.@' .....u{.y...`Q...O...@Y`.._...O...9....h[.<S......hs...%...>.....^.A..~"..o\.M.^.^T...j.b.7...^..2.#Op..".W.......&ugkr.v.M.px..y\.M...`......T..>..cY.Ky;.f..k.v'.e....q.`w....`...%.Gb.7m...&.......>..+J...%.:g..=9D.."....f..D^.V....\|.R.T..6T.N./..E.l.P.'1..B..U.me.0`."*Ef.hL..&.x..?o..U.g.SZl{.....-....3-.....G.6a.g.q...s#..".b..<...@......!....(9.....q...M.dD....;`..Cb.Cyd.zM..Y.....#.S-1...}j.W.7.}.\0I8..Zi`{...>>.E.4..D!DA}T^.R^...f....R'.....W3"...?."......"...j>..'.B.{9...h.A.....5..)5...N...y.......s....U.h...s.#-...M..T/D+g..2..G..2y...@e.5M...{..........{.....t...v.W...e..A.8U..!97..I...xQ...p....E.,...%....a..M..Yo.....7nMg......../J..!.L.~l..;..X.>.q.3...(........&$.............S..i...EAQd.y...V.W..'....# ......rO...c."IQ.-..f._..yp..^s.[.Ih$.4..B...........8ZL...:6\Z...dH.{

C:\Users\user\AppData\Local\Temp\jusched.log.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1996
Entropy (8bit):	6.671326377622902
Encrypted:	false
SSDEEP:	48:LTJCZSpdqkmvWnEYe0yByf39GBr+FjHILZ0mqn:XJODQe0ycfyr+GLKmS
MD5:	C33E39F59151EF94EDD1BD2A0DEB02A4
SHA1:	5FB861732CF4E0975FCA76E9DE4D38E2E528AB79
SHA-256:	E8FD6B0A92785BCC8E3FB3A8028889D90ED3F50B2655DE648C081DBA46BEE290
SHA-512:	BD11C9FB5D5CEEDF95D5AE400F795AE2ADEE5D3FA2F15E67CA127D5A7B7EE0B03934B4683D443EBC0F540CBC6B6C14C0D596ACC16C2639062C5192A968C69B0C
Malicious:	false
Preview:	..l...(.^.....~[...m..k.....i.N !. ..>.!....;#./....1L...?..N{........W.>..0..0..r.5T..i.Hx..1..}.ZK......nx..`D.....b...tkJ....h.h...{....tt.....%\|]..N...H.........b@....".....s....e..2+..Xd..q.Ty.=..j\...>e.r}7=.2r..A..m.......F.#..........?....#.8..5d.-..O.....2]....(rO.......Z......5i..`e..3[N..].1k?=...ai....GU..f...U..D..q.v:.M..5E.pD7Wt.8..\|..'....$+.N.1.b.......!..s....q..zG...N...4.%.X.c...8{Eq..m@..9...._.s....i'n.@.?.VBv+.p)3D......n..n4.r.).$.Y....I...;C...&...,E.;$\...n.%]..y.Tp..vxG....w:4!9.f.`w.~..vW.....H.aS.w.lT......x..Rc_..L]...nYs.F....^w..R..I.Z...!...!...b.y..=.)ZeW^.D..p5x.m..."........%"5..[(....i.;6.k.....KR.`.../hU......P..)^aa...f..;..$&.O%W[."...3..f.g\x.Tr..#.T.....[i.[........Q8.DS..........gv...[(..............?...!.U)....L....x.......1#M._...}.......g".t.z].2.v..gr9}.7.....o;4.er+N.!.R4.OI.w.3FvO.g....hc.. ...`..Yw.8.......n...Dh.D..r;.)~.dg..Gp@---8+8---abbe1bfc1b2d267e88a7874b0c68c

C:\Users\user\AppData\Local\Temp\offline.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	25628
Entropy (8bit):	2.394893193507727
Encrypted:	false
SSDEEP:	96:la1rF3c2VGc930ceDBVLlENhagMiz96mal2iSt3wvtH5hUlF:la1ZcFI33eDBVSh3+M2eF
MD5:	6D6C811129E3DE3219B8FA3924223165
SHA1:	390491198C571AD2D4FAEC672021F8E7BB17ED0B
SHA-256:	8EABFBEBCCC8EE5BFBB2C4F17E8EEACD051BBF73E907CE533DA9E27DBF0CD4A8
SHA-512:	F16D94961B56405FBBC41DA67C244F4BADC592604905CF62FFE47F03DBC6A5D7773B7FC48B43DBA029795CB9F24D1364F7327A4B1B0179F80D2B86D7193697EF
Malicious:	false
Preview:	..zo..\....?.gv..\|...Da..u..S!$._y.).C5...3.l.a9.\K#.<.T.xtlr&[........X...{y+...?..Q...2E#...J.+..i".L. E..i...Ptp.....#..M..%. .</.{6.Q.....+...{8....35#@.........V9P.t.mYcp...6_.....I..gl..0.cHF[..a..Y.G.\=b..cw..p..._..o^..jg.$..0WO.,u...s....<...9..e0:..E45..f.....u.%..7.EReJ ....n.p]#.N.Q.......Y...oo...........t......".d.."..Dk:..-.;..l......#..&.RY.....@m...Q...M..p.7OGtS/.5........dzY.=...r.d.Y.V...(W>.># ...%d...R..l>..7.I...c.z.^..2..J..D<p........g....)..$.!:..+.z.8.#Imi..kZ..yR.....$@..s.@...$..k..Q._a.. ...../..A....^.......X..]...x..L...fF?..!..6..x.....@.W..;......CO..a.+...B...C..../tF!..=.&.... ...........<4.2.1...Zq.S...d..Pd.tNu&......f`/Z..6.R.[..p......2!L.....w...n.h.LJTxs..M.,....580.. et...*.i.&...........9.(Xu.c.4.3..s.v.....{....\|..%.....Q[?I,..........8......4..).R.h..^"{#v......q4:y.?.....;.0X]..{.u@L..G.....g..Mi7F.B... ........&....b..'.I~dL....mK. 5.aS..A..c....9..9........b.$g...s.F.'.....b%

C:\Users\user\AppData\Local\Temp\symsrv.dll.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	168668
Entropy (8bit):	6.347652743451474
Encrypted:	false
SSDEEP:	3072:HFj2KNLrQgdj8TqeF5f5k7ketCn5m3TeKBGXccrf2ZDY32i4:HFj2iLrhjeLf55c4fGDDi4
MD5:	ED2B73315FF5FF83CDC429F42B11F11C
SHA1:	DA7EFAB8F1F2A908BD595EF426F62E6A8CDE29A8
SHA-256:	C41486124B94C02CBC3F8E61026CC4099087530D06EF5D14E499D295FF869F62
SHA-512:	286589C654C1974A804D2F0E70A92F5162445434D1F4648BE097B22C615DD2EFDFFEBA17F2AEB9EA4EEDB326E43996168020E1CD209999605D8B81CDD1866B01
Malicious:	false
Preview:	..zo..\....?.gv.U<.....V.....Y'.~).\|.y._4..+.GPx...5.q....g<eI....mLP._v.Vdp..g......5wj.#e...:..{..c..2Hw......\|V.S1.}.^..._VY......N.&;N.o.4......c.\|<.b.Z.&[)..2....3.S>O..^.h..8........H..%.EB..h5...t.`.G.B#.9.5.......,.a=..........U... 4.G.]'z.:.U...,57...vJ ......(.....[..i..`....JH1..Q...]..N...bM.xF....eX.79...H;D.?.uy......'U)..].C2..f..h84#.v.......C3...}..TU...gz.0\@...[..o....]4......&...n.(.....$..,.}J..6..Q\.}w...Ud...j.5.....b>.@.:y...ux..>`1.p....h=..Fs.....+.A.K.?.l...Ce....9;d.R....X.....S.'{1...c..J$B..i)....>...h..'i.4.S..4......zB..S...D/o. .~./.@a.j.U....k..P...#..jZ.e..J.......<3.+...03W._..;...Jn....?a^....U......,2.jrc.7._.....I!.../j........e.....d.9E...$...r...U....-.....H..\...'.P\|m..vhW.....W5....3g.Z......X..W..I...]..l.5.i,&?..0.g..^..B6aq0..&.lC..u..lY>.U.[..5.Ow.&.x.i._.\|?......d.7.T..;.....e.[......?H.j.KE.^`@........o...-.#.....-(......Sk.~>..... .9a.\...[.......k..C...Vk.^.RIkT..eP..1d...G.k

C:\Users\user\AppData\Local\Temp\tmp.bmp

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	PC bitmap, Windows 3.x format, 1920 x 1080 x 24, image size 6220800, cbSize 6220854, bits offset 54
Category:	dropped
Size (bytes):	6220854
Entropy (8bit):	3.748133439001807
Encrypted:	false
SSDEEP:	98304:SDoRRIfzszbsaX2gRZsn9nuzNexSpFEYD43v:SDoR+zszbsaX2gRZsn9nuUxSQY03v
MD5:	F9B772C6F2C316BA53DEA4DD0AFCDCF4
SHA1:	EAE1E29883F8923794E5F6BF4D894D304C83FAB9
SHA-256:	AD215830E05EA5F9BB232CBCAD27D3FC59DF75059523B2E463329646542A93EB
SHA-512:	BFC9C39131C5A0508785498880E96A82B1F3D79632AAE6C50C1C29C5A2F365A85B86F94B74E9D4BA2ED6ACD403408B19938ADE192D385CB870608F8FA32BAA32
Malicious:	false
Preview:	BM6.^.....6...(.......8.............^...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp.bmp.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	6221906
Entropy (8bit):	4.345248046666188
Encrypted:	false
SSDEEP:	98304:WDDT4UIeWDgwsYNIwxZyGFXPsVz0wNPsXNI2yry6Kr+Jo:WDDT4mWDgwsYNIwPyGdPsVIwsXN8rvKL
MD5:	B2B8EE1F6A7630F2C7AA0A0740BEDBA2
SHA1:	9DC225F9DFA863A82ABEA57CC6D5517817795514
SHA-256:	7A304E9AB74FCB3AB79A65DA35A12B98A2BF253FB411ECA66D597D6F0FD95219
SHA-512:	FCD03D210C2413EB372F69CC9412E1B386176FAF8A0C96FF46C174D1A845EF7D9061A5B9CE89E7F55A6050A0B2FBE17EAB5E1543EBD130141C143235BF44CC33
Malicious:	false
Preview:	..zo..\....?.gv._......1....q.`......N[...HL,u'}-.s....:...E[......;.s.5;.7y.uX6V.2.q;.S.+.f:.B..w...U..F#T...............t......._...95........#? _K.'Q"..!._aj#.QH(G..B.mX.@..\|.....At-.F...&@E...gC.U...z."@&5.y../........F........ E.............p..8A.>M.e.4X$X4..f.i...K.^.P...zE..V.RW............G.._6M'....b.H .k.YD&.d...\.TX?"..)O...c.....l1.E1../9T.Ae...g......:N-P.x..i...J....v..baP.. .x..jZ.i')"..k..3(X^.Na.o._7.4...L}.........ndv&...Z.+v.KqR..D.Z.(~[..YV_... .dj....@........p..3U...v.8....h...y.l\|...F....V..^U...q...1T:....V..4........,Y1.h.at..l>,..H;1..oe.:....j..g.hf..v.p.>.g=........`..q$)...t%...g.*..........P...$.Qm.0...UF;."...p.D.......^..e....sA9.7.L....D.>k.DNQ2}Y..).t..z.,.x..(O..n../...v........)..D..3..Z.v...A.`..;+..d./.03^.g...>.W.O...A.].....CD..L.^x,.p......@.p.p.aH......c.a(%.5(.l.)....C......5.Zg?3)zP...H....u=.r..d...@.ZM....t.P....3..~w"0..?#T.6E.....}.9..x..v.S.Y.Z..1....Tv....:...p.....w3J

C:\Users\user\AppData\Local\Temp\tmpE13E.tmp.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	21262364
Entropy (8bit):	3.370515560533347
Encrypted:	false
SSDEEP:	196608:/DAO/nxbsA8phKEiJ2AY2mgXPtoJVCFAE:bZ5Eb2vXPtorE
MD5:	6C05C6C0CB17EFE73AA60F932A572CD5
SHA1:	D361E03FCF076CFA7D9390D6EEDBF1C6FF7E8236
SHA-256:	936966E141AEF17DA865DAC549334551D84E3B622650A3CB30D991D1813EB652
SHA-512:	CCED14DE09C88DCEA06113D19627AE2D6E158B7B09806EE16C6081208696A44EE29253B70DA2FCCC10D275F81B95126B78771D997C0F019573F9B1FAE60895A4
Malicious:	false
Preview:	..zo..\....?.gv.U<.....V.....Y'.~).\|.y._4..+.GPx...5.q....g<eI.i].e.s.Q.\|.\|...g...H.~y..U...t6.;.=..r..xJ.....V.A...=..:.."...}0..2.....x.9bl..:........;%....].8..L.......0.2D;...S..sni..o.....oEuWXT....{,./..Xf.Y.z.].uL...)............4k`..K....o.q..,..["68 . ?/...).e.+c.....6./W{v.p.qw.....D...[.q.^`>...-L.'wO.Y.#..g..S....A.mM.;u?...H...o..x2...c..Ul.8.}k.L..g...y.(..s%.K...~.1)N...!%6....^.........FU".%.+X.....#...J,.A.\4"..n.}..L.:#t./J.S..]. .X..0M.)y..f.{.....b..j&p!M.....h<..v....^.,..20p.^.....^.......s.5.79y\|...^...0....B..qL...Z.z.....#'..t.<.CN.............#(.U..P.A.Q....H.........#.....J..G.B..0PV....-.(...$#..@>+r.Q"....^p.fN...#...{.,aN.b.TS.G.6..^.....!.>B.5..m.b..3........]h]R..Qrrf..o.......%t/.:?.kF.=.......Nif5Kx..1.Fx.}....S..:]I...... .....mJf.Ch_!.e...TXq.5S.M.4U..G.......,..4.%5.).....D..{#...A.t......O.......=.1h....Cb....4F......W.....jB..;..2.....cO-.b.f.g;b..R<.x.2.G...*.rR..W./6...t.bIx+R.t.w..`.....O.R.....k.j.'.:2.....6

C:\Users\user\AppData\Local\Temp\wct1834.tmp.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	65906
Entropy (8bit):	5.979788691465386
Encrypted:	false
SSDEEP:	768:gOMvXs8yWn7UrDKKmCzHS7vu/ZVGiwP56vcDR+P0rMT7:L4Xs7eUrGwSb4GgvcwkMT7
MD5:	2D6C6BB2161AAB64EC5CD22CD67A3164
SHA1:	BA047C8840A8C4089DC597165737AF513E8F5DF3
SHA-256:	F6E09B545A0775E0045A0BF6156984136601639A460A846CC344C9E9A5D18A18
SHA-512:	217FF293D87CC25D28D77633EA650D0E0D7874F6314A6CD84E31464DA48EDF9C5BF9D2224373680C9E1EB2EFD0C2416AFDD5D46C2F148C6263595B266CD9ECA0
Malicious:	false
Preview:	...w>.......x.g.T..y..]FKI=...L.. 0!.I.K>.9....;.i.....4..D-".'.#./Yu..t(Jx...nqw...."...H.<...?.:.s..=...H..j.A..9.CD....{.]Z\|...b.Y.A.-.r.<.b.R.K.).b...x5.Am.X.....=..U.....T.....Tl..}...o......s...U...DC2]o\x...e......r.l.....g..?..@...v...c.X..<...x...de.BE.cp...J.y.;..r....M(..T.....!......9...h.Dsd..Y\|R......... H&5oh...8..."d.dmg..]..~.........[.>y......>..........E..V..~^.P.....N..R@p.tu..~.I.W3Y.jpK'.....n..G.oDj...p...C...]L..f..\.....P.....m!].refUi.P`N.o..GZo..tY..:[..>$.....W.<..CeTk.mP......1Bn..S(.....V......e.+..{#w.+.+.H...Y......C......`...z....M.GQ)!.u<.......w.3.T......).....).{.%8..~..s....l..y_.1..R.6.a.1..'Vi..2g....[r.&.........d.0.U.k.\|]..N.v...S..C..E.H..cT...,.qs....G"....W.s.........(8..F..,...-..:..IP.y.\..//4w....X.V...vx......a'..p.P...b..,........#.7t@.....D....:.6Tf.&.. ..4.%..C....it.8d.6-.v.U}..'.Y..+.+...L..}...t...Je........7...E......s....6j....I...*T.....4.M...Z.....>d..`..R+...U.0..

C:\Users\user\AppData\Local\Temp\wct42C5.tmp.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	65906
Entropy (8bit):	5.979788691465386
Encrypted:	false
SSDEEP:	768:gOMvXs8yWn7UrDKKmCzHS7vu/ZVGiwP56vcDR+P0rMT7:L4Xs7eUrGwSb4GgvcwkMT7
MD5:	2D6C6BB2161AAB64EC5CD22CD67A3164
SHA1:	BA047C8840A8C4089DC597165737AF513E8F5DF3
SHA-256:	F6E09B545A0775E0045A0BF6156984136601639A460A846CC344C9E9A5D18A18
SHA-512:	217FF293D87CC25D28D77633EA650D0E0D7874F6314A6CD84E31464DA48EDF9C5BF9D2224373680C9E1EB2EFD0C2416AFDD5D46C2F148C6263595B266CD9ECA0
Malicious:	false
Preview:	...w>.......x.g.T..y..]FKI=...L.. 0!.I.K>.9....;.i.....4..D-".'.#./Yu..t(Jx...nqw...."...H.<...?.:.s..=...H..j.A..9.CD....{.]Z\|...b.Y.A.-.r.<.b.R.K.).b...x5.Am.X.....=..U.....T.....Tl..}...o......s...U...DC2]o\x...e......r.l.....g..?..@...v...c.X..<...x...de.BE.cp...J.y.;..r....M(..T.....!......9...h.Dsd..Y\|R......... H&5oh...8..."d.dmg..]..~.........[.>y......>..........E..V..~^.P.....N..R@p.tu..~.I.W3Y.jpK'.....n..G.oDj...p...C...]L..f..\.....P.....m!].refUi.P`N.o..GZo..tY..:[..>$.....W.<..CeTk.mP......1Bn..S(.....V......e.+..{#w.+.+.H...Y......C......`...z....M.GQ)!.u<.......w.3.T......).....).{.%8..~..s....l..y_.1..R.6.a.1..'Vi..2g....[r.&.........d.0.U.k.\|]..N.v...S..C..E.H..cT...,.qs....G"....W.s.........(8..F..,...-..:..IP.y.\..//4w....X.V...vx......a'..p.P...b..,........#.7t@.....D....:.6Tf.&.. ..4.%..C....it.8d.6-.v.U}..'.Y..+.+...L..}...t...Je........7...E......s....6j....I...*T.....4.M...Z.....>d..`..R+...U.0..

C:\Users\user\AppData\Local\Temp\wct4B1.tmp.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	75243
Entropy (8bit):	5.956800395030046
Encrypted:	false
SSDEEP:	768:gOMvo5ypZU9mSzgmLRpwbqLxStzJ8RWzug0vupTzL3ubyrgT0EzUyucAOIa3iP5M:L4lPUQPOTzZvcGZ7
MD5:	C76410F8DA87A4ABEB1256AF0DE058AC
SHA1:	C12F76D88888FA5EB850AAE9A6F6CC9CCEB11947
SHA-256:	8FB7AB58B56866C07B685BE3CEAAA6C16AE828C30E4E925E58B7D3AD727A16E7
SHA-512:	D44BDB19EEEF166D03942ED0268C17E7A7EBCC961C93AFF9B3F086AAB7838C100ED24995FEF4418224A2EF41169139753AC7949821F132DEE3C10CD1D7A06913
Malicious:	false
Preview:	...w>.......x.g.T..y..]FKI=...L.. 0!.I.K>.9....;.i.....4..D-".'.#./Yu..t(Jx...nqw...."...H.<...?.:.s..=...H..j.A..9.CD....{.]Z\|...b.Y.A.-.r.<.b.R.K.).b...x5.Am.X.....=..U.....T.....Tl..}...o......s...U...DC2]o\x...e......r.l.....g..?..@...v...c.X..<...x...de.BE.cp...J.y.;..r....M(..T.....!......9...h.Dsd..Y\|R......... H&5oh...8..."d.dmg..]..~.........[.>y......>..........E..V..~^.P.....N..R@p.tu..~.I.W3Y.jpK'.....n..G.oDj...p...C...]L..f..\.....P.....m!].refUi.P`N.o..GZo..tY..:[..>$.....W.<..CeTk.mP......1Bn..S(.....V......e.+..{#w.+.+.H...Y......C......`...z....M.GQ)!.u<.......w.3.T......).....).{.%8..~..s....l..y_.1..R.6.a.1..'Vi..2g....[r.&.........d.0.U.k.\|]..N.v...S..C..E.H..cT...,.qs....G"....W.s.........(8..F..,...-..:..IP.y.\..//4w....X.V...vx......a'..p.P...b..,........#.7t@.....D....:.6Tf.&.. ..4.%..C....it.8d.6-.v.U}..'.Y..+.+...L..}...t...Je........7...E......s....6j....I...*T.....4.M...Z.....>d..`..R+...U.0..

C:\Users\user\AppData\Local\Temp\wctFE34.tmp.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	42165652
Entropy (8bit):	7.954204422845937
Encrypted:	false
SSDEEP:	786432:fkLGUwOjUFCcPQdf0HF5G6c68h83+9E7STFnUYlQzLUMcqo1fZWa:fkL1HjpcPHG6c179E7KFFQzoqo6a
MD5:	0DBFFBE5759CEC713FAF335E3F3F5704
SHA1:	DC50D844DBD4BA5295E02DB361C38801C84888F4
SHA-256:	C2E04ED9FB81A883EEE5E68403325A0F5550DEC9B6C8CEB300B465217AD5144E
SHA-512:	60D6AC347FCF7573E7DE42C67CA31F795B401BA4583E6863ABF09BC44F938F72EADE635E9A05F086ED765102982F1EA680C67AB93C61FB4D6E224787BDE4278A
Malicious:	false
Preview:	...w>.......xi_8.H.S......v.@..7.x..h,....E.[v.....!C.,..qX#...'..0V.$r`..T.0Z.9x^.SXF<..i.H..Z...].Z.......F>..m... .f..8.>1..{...i.D..g..<T]<T...?..7$.{{...br.Q.o........P3.9H-X.......e..mDg.%V....]y......G...<..4...>.W.g.?q.gM..b....MPb.f-....x..8.H.....l.NPLr...bV2{.........f....c.3g.1..gf.hD...W.........C...9qS...Y.....CT.gg#T...6.... .!VJVC.O.P.... ......_L..!...Z.Nm.,.P.....,=..a.....Hk(.....8G,Ph .D.X. .6..L^.. .%.o...P......y_....j7.%......R.E.i.p..l........D...I.#..-....!.......#.`b\|.-.T.A....tx.5.S.Q....c.d.&....v}....h...R\...;..{ru..#.....)0...J......J!.%.-.z....gn...o.k..X#lg..4V.......;L..:g:...._.Mk......Q..F..#.fi'...."z.....{"....r.w.P.W..n....^B.M...J......1....5.....[.#....... .Ih.v...U>KJ:d.............S..h.hwb<.@.%..@.M..0..g..%7a.......o..}.1.&.......m..G&.....o...)........i.{.W.....J.. .[...h9..@..6..y.C.....@C.i..Y.Cr....a..m...n...l.`..qK.x\b{J..w.+&.R......3..I.;...%Y.dI ....#.M.\...^........0.5G...

C:\Users\user\AppData\Local\Temp\wmsetup.log.daenc

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	data
Category:	dropped
Size (bytes):	1756
Entropy (8bit):	6.367187279447115
Encrypted:	false
SSDEEP:	48:vVc4pimBHWVEhiXSfTiqVO9TAzq+8ALJUCrcuw:v6XmB2VE17PoYLJx6
MD5:	656E8521E41BEE3E1396482A9BC59AE9
SHA1:	760B385031D6AA1ABD1D24BEE27585B43E5D681A
SHA-256:	9474838B7BF56568B15374217A3AE539D71A9DB8A340661667AB76097FB943B9
SHA-512:	BCFD05BCF4751E342CEB5C00D549EC51ECAC46D79580677BA944588516949D304F1875D3CE6E323C045CC8D810066C4161B5D2FB11228CE43597380EBB543827
Malicious:	false
Preview:	...\|.=L5^..u2.&m.J..Ny.".E.).N.9.,.'.H...8.].. .)Zo.?A.....~@..w.z......H...wA8.o..&..S..A'...C.$.".j.A)H3WC..`.q.$....0.......6L...h...0.XA..R.3$m}.o..UjD&V.r8.......{..n8.c.9...p...o#..$....O1.5_.N......gb.>..Q...._...;..\|..V...s...mzpi...z..b..k..+.........F...5.&>."..].1.......a.Q...\|.@.YDE.?......qZ.&.Nx......t.g....=......^A.e...l.G.GgKA...n}....`.... .....f..a...._u....C.PH..$.K.o.....J."W..Pf.}o'.....X..)..%._....#Aa..E,..)T.I..Z..!.>.R=.f..U"E..H..C....&.L:9....^.wtW.\|$.x....^UZ.3g.Di.b...@G.vd..i.F&SR..4.U..6...f..\..W.<U....._..03.....C.....y13%.h.i.s....N.......!-_. ..c..J..WP<-<..6@K...b......0.B.K......R...w.0.g...rw...{0..Wc....}..~..{v..[.vB+]..e.A.......D---8+8*---64edfbc862ac1e43e97618320720a3a52e69036257f45a6f06e44e46a49f5fb2483b5a79ccc2c3648f2ed913343d710e593e7c21e791385032120bc68ab39c382c96ad8c7503889ed0522528a3f3e65e0ba6eb76d38f49784391528ec32fc930ee5191280db2b2ced535452e1a13245746b4a083368eb48c358341c3a1bb348ef38ea0ed9e2ad

C:\Users\user\AppData\Roaming\time.dat

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:LQ:k
MD5:	8371979223147775C9E22E45D0B4635B
SHA1:	1A6CCFDAABBA7201ADF9E61E4D237E6A377AB042
SHA-256:	5876D6B16F56408BE737F35E84F06D5ECE4D77728AEC511387189FCAF90AB8E6
SHA-512:	C01943718531DD9CFAABF29C3A293A90A99D00D8260207DB47A3C8AA59E865D7E27B927FAF9B0C0FF2AB2112456DC66AABE810612C581B212E01E6021EA1873F
Malicious:	false
Preview:	17935

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\W4gFpExSht.exe
File Type:	ASCII text, with very long lines (317), with CRLF line terminators
Category:	dropped
Size (bytes):	2835080
Entropy (8bit):	4.627169657133539
Encrypted:	false
SSDEEP:	12288:8j/AB9IYe8flDGr6mF50kcgE8bk/9KPnmFdWE2:yrBnD
MD5:	31682BAED4079C5BB66CA7E120DE41D2
SHA1:	A44058872816970AD2879FFD9E68E4589B16D797
SHA-256:	20356A2514F3A7968F54BD29996F9310260924C7259BFAED2C1D13981F9AF60C
SHA-512:	3A779DFBD58B5E70A8F0B7797C5096F02D2323A92315C2E289D4D12516B7450F8257C25BB180A12A8C24DB87C4D6A11A682145E476970BB3BF5B37D40DA06F65
Malicious:	false
Preview:	Wallpaper set successfully.....0000000000000000000000000000000000000000000000C:\DumpStack.log.tmp..@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@32..Encrypting File : C:\DumpStack.log.tmp....0000000000000000000000000000000000000000000000C:\pagefile.sys..@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@32..Encrypting File : C:\pagefile.sys....0000000000000000000000000000000000000000000000C:\swapfile.sys..@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@32..Encrypting File : C:\swapfile.sys....0000000000000000000000000000000000000000000000C:\Users\user\.curlrc..@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@0..1111111111111111111111111111111111111111(null)..2222222222222222222222222222222C:\Users\user\.curlrc.daenc..3333333333333333333333333333333C:\Users\user\.curlrc.daenc..Encrypting File : C:\Users\user\.curlrc....0000000000000000000000000000000000000000000000C:\Users\user\3D Objects\desktop.ini..@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@0..1111111111111111111111111111111111111111(null)..222222222222222222222222

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	2.5884082780682127
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	W4gFpExSht.exe
File size:	21'261'312 bytes
MD5:	57e7e2151ac4443d3a30d61d4426428a
SHA1:	b2adca307d1f5d1c92cfcdac269ccf269bd8155a
SHA256:	4331d2c1d7e3b285c951be6ab77984072044cb0085e71b448d6858c421826bc8
SHA512:	80059d4d6758ae455bb6dc249454e8ae02817e22818a5faf3187eb8e57ea7889aaac7ecafb39e212d5aac08b6f7c0ef1e85314d84679dbddb45d6862a71f4702
SSDEEP:	98304:l3sDoRRIfzszbsaX2gRZsn9nuzNexSpFEYD43v:aDoR+zszbsaX2gRZsn9nuUxSQY03v
TLSH:	5E27A55785067131EF2A1A3100F6172C67339DDC672F7BAB15397AB6E8B28907E9E0C1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................................7...........................Ur......Ur......Ur......eq......eqq.....eq......Rich............PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x401387
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x66884BBB [Fri Jul 5 19:38:35 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	4582c2025d00ac1e387c86307f8bfdf1

Entrypoint Preview

Instruction
call 00007FDDC862213Dh
jmp 00007FDDC8621CD9h
jmp 00007FDDC862BF60h
push ebp
mov ebp, esp
jmp 00007FDDC8621E6Fh
push dword ptr [ebp+08h]
call 00007FDDC862DB18h
pop ecx
test eax, eax
je 00007FDDC8621E71h
push dword ptr [ebp+08h]
call 00007FDDC862BF30h
pop ecx
test eax, eax
je 00007FDDC8621E48h
pop ebp
ret
cmp dword ptr [ebp+08h], FFFFFFFFh
je 00007FDDC8622527h
jmp 00007FDDC8622504h
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007FDDC8621E7Bh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007FDDC8621E6Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007FDDC8621E6Eh
add edx, 28h
cmp edx, esi
jne 00007FDDC8621E4Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007FDDC8621E5Bh
push esi
call 00007FDDC86226D5h
test eax, eax
je 00007FDDC8621E82h
mov eax, dword ptr fs:[00000018h]
mov esi, 0042D9F4h
mov edx, dword ptr [eax+04h]
jmp 00007FDDC8621E66h
cmp edx, eax
je 00007FDDC8621E72h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007FDDC8621E52h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
jne 00007FDDC8621E69h
mov byte ptr [0042D9F8h], 00000001h
call 00007FDDC86224C0h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2a5c4	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x32000	0x141b170	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x29590	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x294d0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x20c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2190c	0x21a00	40875ea8ae734a63015d0db0c3e0abe8	False	0.5512604553903345	COM executable for DOS	6.632169232905022	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x80fe	0x8200	a0e9c1185bebd84bb4323090adb409c5	False	0.4584435096153846	data	5.17951739986758	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2c000	0x5d0c	0x1a00	87d8787155f37ecd921647b1c88d2048	False	0.4774639423076923	DOS executable (block device driver)	4.6520593593469	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x32000	0x141b170	0x141b200	fd27718cb388a7c4b642dc3133d9774f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AFX_DIALOG_LAYOUT	0x322c8	0x2	data	English	United States	5.0
RT_BITMAP	0x322d0	0x4b9628	Device independent bitmap graphic, 1920 x 860 x 24, image size 4953600	English	United States	0.0010137557983398438
RT_BITMAP	0x4eb8f8	0x5eec28	Device independent bitmap graphic, 1920 x 1080 x 24, image size 6220800	English	United States	0.1290884017944336
RT_BITMAP	0xada520	0x4b9628	Device independent bitmap graphic, 1920 x 860 x 24, image size 4953600	English	United States	0.0010137557983398438
RT_BITMAP	0xf93b48	0x4b9628	Device independent bitmap graphic, 1920 x 860 x 24, image size 4953600	English	United States	0.0010137557983398438
RT_DIALOG	0x321a0	0x124	data	English	United States	0.565068493150685

Imports

DLL	Import
USER32.dll	EndPaint, GetWindowLongW, PostMessageW, SetWindowPos, EndDialog, GetSystemMetrics, ShowWindow, OpenClipboard, GetDlgItemTextA, SetTimer, DrawTextA, CloseClipboard, EmptyClipboard, MessageBoxA, LoadBitmapW, SetClipboardData, wsprintfW, GetClientRect, GetDlgItem, SetRect, KillTimer, SystemParametersInfoW, DialogBoxParamW, FindWindowA, LoadImageW, InvalidateRect, BeginPaint, MessageBoxW
GDI32.dll	CreateFontA, SelectObject, CreateCompatibleDC, StretchBlt, DeleteDC, SetTextColor, SetBkMode, GetObjectW, SetStretchBltMode, DeleteObject
SHELL32.dll	SHGetFolderPathA
KERNEL32.dll	GetCPInfo, GetOEMCP, GetACP, IsValidCodePage, FindFirstFileExW, GetFileSizeEx, WideCharToMultiByte, GetEnvironmentStringsW, LCMapStringW, CompareStringW, FreeEnvironmentStringsW, SetEnvironmentVariableW, GetStringTypeW, GetProcessHeap, FlushFileBuffers, WriteConsoleW, HeapSize, HeapReAlloc, MultiByteToWideChar, UnhandledExceptionFilter, HeapFree, HeapAlloc, GetLastError, SizeofResource, FindFirstFileW, FindNextFileW, WriteFile, WaitForMultipleObjects, GetTempPathW, FindClose, CreateFileW, GetSystemDirectoryW, FreeResource, Sleep, LockResource, GlobalAlloc, CloseHandle, CreateThread, LoadResource, FindResourceW, GlobalLock, GetModuleHandleW, GetConsoleWindow, GlobalUnlock, GetDriveTypeW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, DecodePointer, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetCurrentProcess, TerminateProcess, SetStdHandle, RaiseException, RtlUnwind, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, EncodePointer, SetEndOfFile, SetFilePointerEx, DeleteFileW, ReadFile, GetConsoleMode, ReadConsoleW, GetFileType, GetConsoleOutputCP, ExitProcess, GetModuleHandleExW, QueryPerformanceFrequency, GetStdHandle, GetModuleFileNameW, GetCommandLineA, GetCommandLineW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	04:14:37
Start date:	06/10/2024
Path:	C:\Users\user\Desktop\W4gFpExSht.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\W4gFpExSht.exe"
Imagebase:	0x400000
File size:	21'261'312 bytes
MD5 hash:	57E7E2151AC4443D3A30D61D4426428A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	04:14:37
Start date:	06/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	13%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	20

Executed Functions

Function 00421840 Relevance: 135.4, APIs: 67, Strings: 10, Instructions: 630
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00421864
GetSystemMetrics.USER32(00000000), ref: 004218B3
GetSystemMetrics.USER32(00000001), ref: 004218BB
GetSystemMetrics.USER32(00000032), ref: 004218C3
GetSystemMetrics.USER32(00000031), ref: 004218C8
GetModuleHandleW.KERNEL32(00000000,0000006B,00000001,00000000), ref: 004218D1
LoadImageW.USER32(00000000), ref: 004218D8
SetWindowPos.USER32(?,00000000,?,-000000FA,00000320,000001F4,00000014), ref: 0042190C
SetTimer.USER32(?,00000D80,000003E8,00000000), ref: 0042191F
GetWindowLongW.USER32(?,000000FA), ref: 0042194D
LoadBitmapW.USER32(00000000), ref: 00421954
BeginPaint.USER32(?,?), ref: 004219CD
CreateCompatibleDC.GDI32(00000000), ref: 004219DA
SelectObject.GDI32(00000000,?), ref: 004219EF
GetObjectW.GDI32(?,00000004,?), ref: 00421A00
GetClientRect.USER32(?,?), ref: 00421A0E
SetStretchBltMode.GDI32(00000000,00000004), ref: 00421A17
StretchBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00000780,0000035C,00CC0020), ref: 00421A41
SetTextColor.GDI32(00000000,000000FF), ref: 00421A4D
SetBkMode.GDI32(00000000,00000001), ref: 00421A56
SetRect.USER32(?,?,?,?,?), ref: 00421A76
MessageBoxW.USER32(?,Are you sure this is right decription key? If not, you can loose all files...,Start Decryption,00000024), ref: 00421D67
GetDlgItemTextA.USER32(?,000003E9,?), ref: 00421D9D
MessageBoxA.USER32(00000000,Decryption Key is not correct!,00000000,00000000), ref: 00421DC9
InvalidateRect.USER32(?,00000000,00000000), ref: 00421F64
KillTimer.USER32(?,00000D80), ref: 00421F97
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00421FAD
MessageBoxW.USER32(00000000,Decryption Completed!Bye!See you later!,Decrypt Completed!,00000000), ref: 00422017

Strings

%s\time.dat, xrefs: 00421875, 00421FEB
Decryption Completed!Bye!See you later!, xrefs: 00422010
Are you sure this is right decription key? If not, you can loose all files..., xrefs: 00421D61
Decryption Key is not correct!, xrefs: 00421DC2
%s\dec_key.dat, xrefs: 00421E0A, 00421FBE
Decrypt Completed!, xrefs: 0042200B
Decrypting..., xrefs: 00421CF8
Arial, xrefs: 00421A7C, 00421CC0
%02d:%02d:%02d, xrefs: 00421B05
Start Decryption, xrefs: 00421D5C

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: MetricsSystem$MessageRect$FolderLoadModeObjectPathStretchTextTimerWindow$BeginBitmapClientColorCompatibleCreateHandleImageInvalidateItemKillLongModulePaintSelect
String ID: %02d:%02d:%02d$%s\dec_key.dat$%s\time.dat$Are you sure this is right decription key? If not, you can loose all files...$Arial$Decrypt Completed!$Decrypting...$Decryption Completed!Bye!See you later!$Decryption Key is not correct!$Start Decryption
API String ID: 3229189901-2570948240
Opcode ID: 4866681add3663ff16eda0f619157386021bc83a8f4716772e27b75dac919198
Instruction ID: 993d4b58a9db8e3aca23216036d45ff1d62b3667e3ce8f14e5e7d5a5fb316925
Opcode Fuzzy Hash: 4866681add3663ff16eda0f619157386021bc83a8f4716772e27b75dac919198
Instruction Fuzzy Hash: AE221971744304BBE7209F60DC0AFAA7BB8EF48701F40052AFA45E61E1D7B99A45CB9D

Function 00422240 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 360
filesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004222C7
wsprintfW.USER32 ref: 00422332
wsprintfW.USER32 ref: 004223BE
FindFirstFileW.KERNELBASE(?,?), ref: 004223D1
Sleep.KERNELBASE(0000000A), ref: 00422625
FindNextFileW.KERNELBASE(?,?), ref: 00422635
FindClose.KERNELBASE(?), ref: 004226D2
FindClose.KERNEL32(?), ref: 004226F7

Part of subcall function 0041B5A0: __wsopen_s.LIBCMT ref: 0041B641
Part of subcall function 0041B5A0: GetLastError.KERNEL32 ref: 0041B649

Strings

Encrypting File : %s, xrefs: 004225D4
DxxAlien_ReadMe.txt, xrefs: 004225AC, 00422665
daenc, xrefs: 00422590, 004225EF
Users, xrefs: 00422320
%c:\%s, xrefs: 0042232C
%s*.*, xrefs: 004223B8
Decrypting File : %s, xrefs: 00422616

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: Find$CloseFilewsprintf$DirectoryErrorFirstLastNextSleepSystem__wsopen_s
String ID: %c:\%s$%s*.*$Decrypting File : %s$DxxAlien_ReadMe.txt$Encrypting File : %s$Users$daenc
API String ID: 3503517984-2055918687
Opcode ID: a9bc7c974c48b1823ddcc2b813b0d1a23e12d27a0ac40f09e4a0af0e6f799c05
Instruction ID: b666c12a07874375f28d44379d07fc79861115ef2275d73f526bd2733b17f407
Opcode Fuzzy Hash: a9bc7c974c48b1823ddcc2b813b0d1a23e12d27a0ac40f09e4a0af0e6f799c05
Instruction Fuzzy Hash: 91C1E971B00129AACF20EB65DD41AFA73B9FF14304F8401ABF945E3290E7799E85C699

Function 0041F2A0 Relevance: 1.7, Strings: 1, Instructions: 479COMMON

Download Yara Rule

Strings

mpAlloc: Unable to allocate memory., xrefs: 0041F7A7, 0041F7B1, 0041F7BB, 0041F7C5

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID:
String ID: mpAlloc: Unable to allocate memory.
API String ID: 0-845280520
Opcode ID: 928a45c471d8f0cba9bbd1927331f7596a29df266f72d159d691741b5bdc33e5
Instruction ID: 7bcfce2893fe6dca9a5790d0060ad21e8c4fae8e2125bb53224ae076a8bc33ae
Opcode Fuzzy Hash: 928a45c471d8f0cba9bbd1927331f7596a29df266f72d159d691741b5bdc33e5
Instruction Fuzzy Hash: CA029175E002199BCF10CEA8C480AEEB7B6EF89314F54417AED05AB341D739DD86CB98

Function 0041B5A0 Relevance: 17.8, APIs: 3, Strings: 7, Instructions: 321
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsopen_s.LIBCMT ref: 0041B641
GetLastError.KERNEL32 ref: 0041B649
__wsopen_s.LIBCMT ref: 0041B6FD

Strings

daenc, xrefs: 0041B6DD
---*8+8*---, xrefs: 0041B8AA
0000000000000000000000000000000000000000000000%s, xrefs: 0041B626
3333333333333333333333333333333%s, xrefs: 0041B792
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@%d, xrefs: 0041B650
1111111111111111111111111111111111111111%s, xrefs: 0041B669
2222222222222222222222222222222%s, xrefs: 0041B710

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: __wsopen_s$ErrorLast
String ID: 0000000000000000000000000000000000000000000000%s$---*8+8*---$1111111111111111111111111111111111111111%s$2222222222222222222222222222222%s$3333333333333333333333333333333%s$@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@%d$daenc
API String ID: 911620403-3710021843
Opcode ID: a2e69601075cdee952268e9d5c166b148ae3c472e2961741eb67419b7b0f5ab9
Instruction ID: b30e46ec93c379b2f2636d76d5bf74b2c76887b23c041f499121fdc9f1b07ad6
Opcode Fuzzy Hash: a2e69601075cdee952268e9d5c166b148ae3c472e2961741eb67419b7b0f5ab9
Instruction Fuzzy Hash: 21B1EEB2D10218ABDF10EB95DC42BDEB774EF48304F14413AF904B7281EB795A558B99

Function 0040A246 Relevance: 13.8, APIs: 9, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00409EFF: CreateFileW.KERNELBASE(?,00000000,?,0040A2EF,?,?,00000000,?,0040A2EF,?,0000000C), ref: 00409F1C

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A35A
__dosmaperr.LIBCMT ref: 0040A361
GetFileType.KERNELBASE(00000000), ref: 0040A36D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A377
__dosmaperr.LIBCMT ref: 0040A380
CloseHandle.KERNEL32(00000000), ref: 0040A3A0
CloseHandle.KERNEL32(00000000), ref: 0040A4ED
GetLastError.KERNEL32 ref: 0040A51F
__dosmaperr.LIBCMT ref: 0040A526

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: b3df3b61fc8365887e2033e239f2f1e7430f2f4a2866fb6334f6c917d42e5942
Instruction ID: 08aac694a84ab1dcfa77ca7ed58882339a8966c65afae20b1fa1228b46d37dca
Opcode Fuzzy Hash: b3df3b61fc8365887e2033e239f2f1e7430f2f4a2866fb6334f6c917d42e5942
Instruction Fuzzy Hash: 89A12532A142149FCF19DF78DC51BAE7BA1AB06314F18016EF811AB3D1C7398926CB5A

Function 00405149 Relevance: 9.3, APIs: 6, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08e3a57559d4055a691f5c9859e891c2b54037a5ce6949867dc7343bd00564b1
Instruction ID: 874e2a0bb251699eb2ee493e9d2610a6325ffc37026171f07eca4d995154daee
Opcode Fuzzy Hash: 08e3a57559d4055a691f5c9859e891c2b54037a5ce6949867dc7343bd00564b1
Instruction Fuzzy Hash: F2B1B170E04605AFDB119FA9C881BAFBBB0EF45344F14417AE901AB3D2C7789942CF99

Function 00422730 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19
sleepwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindWindowA.USER32(TaskManagerWindow,00000000), ref: 0042274C
PostMessageW.USER32(00000000,00000010,00000000,00000000), ref: 00422759
Sleep.KERNELBASE(000003E8), ref: 00422760

Strings

TaskManagerWindow, xrefs: 00422747

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: TaskManagerWindow
API String ID: 529655941-548990918
Opcode ID: fad56a8e48e8b9dbb0d5305292874e23baba440781c3f08c48156d59b1b0ee69
Instruction ID: a3141d77e2b975e59d8685c451bc7c1de5d758efa68bd9c018e8580b7f25fab8
Opcode Fuzzy Hash: fad56a8e48e8b9dbb0d5305292874e23baba440781c3f08c48156d59b1b0ee69
Instruction Fuzzy Hash: 86D05E31780326B7E6305B956C82F66A26C7B8CB01FA400127300B71D089D8B912877D

Function 0040AC70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,0040B219,?,?,?,?,?,00000000), ref: 0040AD0C
GetLastError.KERNEL32(?,0040B219,?,?,?,?,?,00000000,00000000,?,00404626,00000000,00000000,00404563,?,00000000), ref: 0040AD32

Strings

5iM, xrefs: 0040AC7F

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: 5iM
API String ID: 442123175-3048065998
Opcode ID: 72608eb9be815e3972d3a4e74969255152391dfcb6950b0dea8d031c5c08ea83
Instruction ID: ea93f1005c3f4eb05fb6802d60bc374959188764f94e03fcc5b962e0a4bf366c
Opcode Fuzzy Hash: 72608eb9be815e3972d3a4e74969255152391dfcb6950b0dea8d031c5c08ea83
Instruction Fuzzy Hash: 4F21A031B002189FDB25CF29CD809D9B7BAEF49305F1040BAEA46E7251D634DE42CB69

Function 00404B08 Relevance: 4.5, APIs: 3, Instructions: 17
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(004226F1,?,004226F1,?), ref: 00404B10
GetLastError.KERNEL32(?,004226F1,?), ref: 00404B1A
__dosmaperr.LIBCMT ref: 00404B21

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: DeleteErrorFileLast__dosmaperr
String ID:
API String ID: 1545401867-0
Opcode ID: b4e509c3c4808050dcc6aebe3a94b52a83d8923575597c3a697dc619d44cf240
Instruction ID: d98cbe566b5286ff0e9cf0042b16abe35fb1d48146b33d7e5a6159046d701442
Opcode Fuzzy Hash: b4e509c3c4808050dcc6aebe3a94b52a83d8923575597c3a697dc619d44cf240
Instruction Fuzzy Hash: 6AD0C93220410867CA102FF6BC0891B7B6C9A913B63540A36F52CC56E1DE3AD9619559

Function 0040B0AE Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040A7C4: GetConsoleOutputCP.KERNEL32(4D6935E9,00000000,00000000,?), ref: 0040A827

WriteFile.KERNELBASE(?,?,?,00404626,00000000,?,00000000,00000000,?,00404626,00000000,00000000,00404563,?,00000000,?), ref: 0040B233
GetLastError.KERNEL32(?,00404626,00000000,00000000,00404563,?,00000000,?,?,?,?,?), ref: 0040B23D

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 352e7c25a45c750a70836f05a59f0ea1f119f09cebe04dc5cd30da20543222a7
Instruction ID: f8bfc9939b812a3fbb9a213a2c4c699dd678660161ab527428a354f4c2c2eeca
Opcode Fuzzy Hash: 352e7c25a45c750a70836f05a59f0ea1f119f09cebe04dc5cd30da20543222a7
Instruction Fuzzy Hash: 7D61A371D04109AFDF11CFA8C884AEFBBB9EF05304F1401AAE900BB295D339D9128B9D

Function 00404575 Relevance: 3.2, APIs: 2, Instructions: 151
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEndOfFile.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00404563,?,?,?,?,00000000,?), ref: 004046C1
GetLastError.KERNEL32(?,?,?,?,00404563,?,?,?,?,00000000,?), ref: 004046CB

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: c488f3bb10a27faf4b5bce6e3fb6c168e90e4b2c2f1de81cdf2b104219ff2c9f
Instruction ID: a8b2b92d58157d178a84b9c70998a1959ae7ee28a2e1d64a40477cc00dd13e0f
Opcode Fuzzy Hash: c488f3bb10a27faf4b5bce6e3fb6c168e90e4b2c2f1de81cdf2b104219ff2c9f
Instruction Fuzzy Hash: 6D5129F1900205AADB149F65CC41B9E77B4AB85324F14063FE710B22D1E77EA990CB98

Function 00404868 Relevance: 3.1, APIs: 2, Instructions: 52
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,?,00404954,?,?,?,?,?), ref: 004048A4
GetLastError.KERNEL32(?,?,?,?,00404954,?,?,?,?,?,00000000,?,?,?,00000000), ref: 004048B1

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 14bf03e880674ee65f59d939607dac696296964714b515722b5abbe79f07ade2
Instruction ID: b1dd1b5bed9560cb006d497d2d5003555d91b4223b5517752a6fe551a4e7ae44
Opcode Fuzzy Hash: 14bf03e880674ee65f59d939607dac696296964714b515722b5abbe79f07ade2
Instruction Fuzzy Hash: 37016637B10144AFCF049F99DC0589E3B69EBC1320B24062AF911AB2D0E634ED428B94

Function 004221C0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 31
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00422240: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004222C7
Part of subcall function 00422240: wsprintfW.USER32 ref: 00422332

Sleep.KERNEL32(000003E8), ref: 00422213

Strings

:, xrefs: 004221D0

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: DirectorySleepSystemwsprintf
String ID: :
API String ID: 649109447-336475711
Opcode ID: 2d9a1f0eedb6236c1c0f191496b42a3dd04fd2ef4ee6fb10c9ce440871190079
Instruction ID: 8aee67786666ec049f21a07629d99e257e186404deb9a3aea34effd9104acd29
Opcode Fuzzy Hash: 2d9a1f0eedb6236c1c0f191496b42a3dd04fd2ef4ee6fb10c9ce440871190079
Instruction Fuzzy Hash: 95F02430614354AED310EBA4EC4179A7BE0EF45300F8091BEE858472B2E7B69B85C3DE

Function 0040DBE3 Relevance: 3.0, APIs: 2, Instructions: 22
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00412E79,?,00000000,?,?,00412E9E,?,00000007,?,?,0041329E,?,?), ref: 0040DBF9
GetLastError.KERNEL32(?,?,00412E79,?,00000000,?,?,00412E9E,?,00000007,?,?,0041329E,?,?), ref: 0040DC04

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: ca210336de386d325468629e182fa0ad1838d0edcb585ce090a1b71d1253acd5
Instruction ID: b1a7e0a11c1e53ecda846d8c323544b25e2d0c15dfcdf4ce8df8febee573882a
Opcode Fuzzy Hash: ca210336de386d325468629e182fa0ad1838d0edcb585ce090a1b71d1253acd5
Instruction Fuzzy Hash: F1E08631600214ABDB212FB2FC087853B69AB46356F504435F608E61A1C67C8966CB9C

Function 00421810 Relevance: 3.0, APIs: 2, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,00000065,00000000,00421840,00000000), ref: 0042182D
DialogBoxParamW.USER32(00000000), ref: 00421830

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: DialogHandleModuleParam
String ID:
API String ID: 3900296288-0
Opcode ID: 09588ae5c1a829a883b209066819e856d372507e2b32c1fcb2eb8b9cbd6e1c01
Instruction ID: 48b0745d61eb9dde65e57598ab583af3b0fe052a44f7e5410e18b71db94ae786
Opcode Fuzzy Hash: 09588ae5c1a829a883b209066819e856d372507e2b32c1fcb2eb8b9cbd6e1c01
Instruction Fuzzy Hash: CBC08C317C03247AE1302B512C0BF52266DAB66F92FB50022F308BB1E05AE874024AEC

Function 0040A724 Relevance: 2.6, APIs: 2, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,00000000,CF830579,?,0040A5DB,00000000,CF830579,00429FC0,0000000C,0040A6C7,0040BB24,?), ref: 0040A77A
GetLastError.KERNEL32(?,0040A5DB,00000000,CF830579,00429FC0,0000000C,0040A6C7,0040BB24,?), ref: 0040A784

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ea2f1ff89e3c3bf1f710cf28edd1c68d7cef95912028c88144ae95da94442556
Instruction ID: 978781bc4aae77c4d21c3a93a158b5718d98d2f7a69daccf70b708cd5cae0436
Opcode Fuzzy Hash: ea2f1ff89e3c3bf1f710cf28edd1c68d7cef95912028c88144ae95da94442556
Instruction Fuzzy Hash: 5C118C33B003101AC62022719846B6F7B798B82738F66413FF805BB2D6DA3CDC46819E

Function 0040DB86 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,0040E362,00000001,00000364,?,00000005,000000FF,?,0042265C,?,0000030C,?), ref: 0040DBC7

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a8a1d56f3af4aaba76909678e9876560f32be171c7997f799b92c96c9348eb1e
Instruction ID: 67d96221f23eb7507a329820fc8fde66a45370972d1b1975321599fdf572fa98
Opcode Fuzzy Hash: a8a1d56f3af4aaba76909678e9876560f32be171c7997f799b92c96c9348eb1e
Instruction Fuzzy Hash: FFF09631A0422066DB316AA79C05A5777A49F41770F164137E809B73D5DA78E90A82AD

Function 0040EFD8 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00412419,?,?,00412419,00000220), ref: 0040F00A

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a75a86ff66efd8c66a4c72151e9188bc2305d7f0d1762246ba4dfe0c5030c5c3
Instruction ID: 4ce40679c94f273cace4d65a16946ad617aae62ffa6e1b7f6d56465dd1ba5161
Opcode Fuzzy Hash: a75a86ff66efd8c66a4c72151e9188bc2305d7f0d1762246ba4dfe0c5030c5c3
Instruction Fuzzy Hash: B6E0653160021167E7312F66AC04B5B3648AB413A8F550137EC08B6BD3CB3EDC0A91AD

Function 00409EFF Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,00000000,?,0040A2EF,?,?,00000000,?,0040A2EF,?,0000000C), ref: 00409F1C

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 201a5b9a27e9921ab18936582ab9adea995e3d56b43cbb4aa91ee185d53fc32d
Instruction ID: b12041c3212dae0ef7992070ea6fd0072dcb3cf981766238861525c1aa87979b
Opcode Fuzzy Hash: 201a5b9a27e9921ab18936582ab9adea995e3d56b43cbb4aa91ee185d53fc32d
Instruction Fuzzy Hash: 1FD06C3210010DBFDF128F84ED06EDA3FAAFB48714F014010BE1856120C736E922AB94

Non-executed Functions

Function 0041456B Relevance: 12.0, APIs: 1, Strings: 5, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00414782

Strings

1#INF, xrefs: 004146A1
1#IND, xrefs: 00414670
5iM, xrefs: 00414576
1#QNAN, xrefs: 0041467E
1#SNAN, xrefs: 00414677

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN$5iM
API String ID: 4168288129-3474312079
Opcode ID: d54ccac07db9c817d5d5834c47a9108f332f7cac65f6f76c9a76f063131baaeb
Instruction ID: 60a1493847db533acfffe28f586f715fbd3fde2a950fc048399aec4cc83a7b85
Opcode Fuzzy Hash: d54ccac07db9c817d5d5834c47a9108f332f7cac65f6f76c9a76f063131baaeb
Instruction Fuzzy Hash: 85D22771E08629CFDB65CE28DD407EAB7B5EB84305F1441EAD40DA7240E778AEC58F85

Function 0040DC46 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0040DD3E
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040DD48
UnhandledExceptionFilter.KERNEL32(?), ref: 0040DD55

Strings

5iM, xrefs: 0040DC51

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: 5iM
API String ID: 3906539128-3048065998
Opcode ID: af389af05184f48cdf4d8c693138e9d98b5a29dc136849e3e193c7b9db794054
Instruction ID: cf29d379f093eee62afe688fcaaaf6effc2b1679fbec356ff8ff670cf2045fb2
Opcode Fuzzy Hash: af389af05184f48cdf4d8c693138e9d98b5a29dc136849e3e193c7b9db794054
Instruction Fuzzy Hash: 1631C6759012189BCB21DF69D989B8DBBB8BF08310F5041EAE40CA7291E7749F858F58

Function 004140C0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19097acf1d52435e6b222b93b70b89d88c33cb33a1041c1d682c3c42031b2543
Instruction ID: 01cf8ed1da6d1480cf4c86ee30fec7ad9874c42aa22915b327fbed685a37725a
Opcode Fuzzy Hash: 19097acf1d52435e6b222b93b70b89d88c33cb33a1041c1d682c3c42031b2543
Instruction Fuzzy Hash: C4022D71E012199BDF14CFA9D9806EEBBB1FF88314F14826AE919E7340D735A981CB94

Function 0040841F Relevance: 2.8, Strings: 2, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 0040858F
5iM, xrefs: 00408427

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID:
String ID: 0$5iM
API String ID: 0-3748854774
Opcode ID: 1fbae01cfd4dd658043c5d7b9984dffffad10a98e22dc796403808ea77141f04
Instruction ID: dcc0be242c453b43301e47d4a9cfbbcdbf64b9bfbce50302b6bc940099d9f557
Opcode Fuzzy Hash: 1fbae01cfd4dd658043c5d7b9984dffffad10a98e22dc796403808ea77141f04
Instruction Fuzzy Hash: 70C1BB705006069FCB24CF68CA84A6BBBA1AB05304F240A3FD4D2B77D2DF39AD45CB59

Function 0040877E Relevance: 2.8, Strings: 2, Instructions: 328COMMON

Download Yara Rule

Strings

5iM, xrefs: 00408786
0, xrefs: 00408912

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID:
String ID: 0$5iM
API String ID: 0-3748854774
Opcode ID: 939c050fa7428896a97f4c068ecd8623d5b468b6f13ac28d7c0e4166b41bfc16
Instruction ID: da3b50c581a59a3160e2dccbab38a877a2c10c97fc27cfaa15dc9ee1df986d94
Opcode Fuzzy Hash: 939c050fa7428896a97f4c068ecd8623d5b468b6f13ac28d7c0e4166b41bfc16
Instruction Fuzzy Hash: 9FB1A271A006068ACB28DE698A449BFB7B1AF44314F54853FD4C2B77D1DB38AD42CB59

Function 004080DD Relevance: 2.8, Strings: 2, Instructions: 318COMMON

Download Yara Rule

Strings

5iM, xrefs: 004080E5
0, xrefs: 00408261

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID:
String ID: 0$5iM
API String ID: 0-3748854774
Opcode ID: 8155ceba8b5fbda448fb8c877eb945a7e48d4dba3a1061382e667d7668d480a8
Instruction ID: f22602884677e8ce11d8d2faa03a05a0f906d442de24f983eed2100c2738224d
Opcode Fuzzy Hash: 8155ceba8b5fbda448fb8c877eb945a7e48d4dba3a1061382e667d7668d480a8
Instruction Fuzzy Hash: 43B1A470500A0A9BCB248E69CA556BF77A1AF40304F14063FD9D2BB7D1DF39AD128B59

Function 00418D0F Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00418D0A,?,?,00000008,?,?,0041890D,00000000), ref: 00418F3C

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: ca079592e913cef8b622a5ba12169945fafaea3225ad13a30810cf341b60d359
Instruction ID: 7ae989ccae5fa34be7a685a50486b4d0e50e0d39fab97c7009da75f55a234f9e
Opcode Fuzzy Hash: ca079592e913cef8b622a5ba12169945fafaea3225ad13a30810cf341b60d359
Instruction Fuzzy Hash: 49B14B31210608DFD715CF28C486BA57BE1FF45364F25865EE899CF2A1CB39E992CB48

Function 0041CC10 Relevance: .6, Instructions: 569COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e6669cf4adcbc354cc64ee2e5fcb756457747899ae0dcd64665a84a304627c6
Instruction ID: ed18be7d2d1e9a922d885ad880476bdf5448937e908b4e6b7740ea4cbf0ead89
Opcode Fuzzy Hash: 7e6669cf4adcbc354cc64ee2e5fcb756457747899ae0dcd64665a84a304627c6
Instruction Fuzzy Hash: 07426E74E101648FEB08CF6AD89056ABBF1FB89300B5582BED955E7361C734AA11CFA4

Function 0041FDE0 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0db3bad4e8f4f5f55dfbd45287799f0088ea6aa7a74d2e89eb1679e3a6a02169
Instruction ID: 4693196b6ef484fc10f3059a3491086a3378b68e2be20121685d10e5a5721d0e
Opcode Fuzzy Hash: 0db3bad4e8f4f5f55dfbd45287799f0088ea6aa7a74d2e89eb1679e3a6a02169
Instruction Fuzzy Hash: C6519F71F001298BEB0CCE6DC9911ADF7A6EBC8310B54867ED816EB399DA709E45C784

Function 0041BA40 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7f8eb4ab23bac10af827c227119a949167c54ccf1cc995dbc9397feb00a73fb
Instruction ID: b15354eb533bd75682adec9c7712aae32009a8855738fdd7d09f994e3ef024ca
Opcode Fuzzy Hash: b7f8eb4ab23bac10af827c227119a949167c54ccf1cc995dbc9397feb00a73fb
Instruction Fuzzy Hash: 68514B71A041254BEB188E2A84A43F67BE1DF96305F5552BBDCCDC7282C63C455A9BA0

Function 00402060 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00402097
___except_validate_context_record.LIBVCRUNTIME ref: 0040209F
_ValidateLocalCookies.LIBCMT ref: 00402128
__IsNonwritableInCurrentImage.LIBCMT ref: 00402153
_ValidateLocalCookies.LIBCMT ref: 004021A8
___vcrt_initialize_locks.LIBVCRUNTIME ref: 004021BE
___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 004021D3

Strings

0"@, xrefs: 00402145, 0040214E, 0040215F
5iM, xrefs: 00402112, 0040218F
csm, xrefs: 0040213D

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record___vcrt_initialize_locks___vcrt_uninitialize_locks
String ID: 0"@$csm$5iM
API String ID: 1385549066-642145045
Opcode ID: 9506f20e7c06e9eb0a58547a959aa46dddf60b4aa5bf7b1f35dc1a76c50921f0
Instruction ID: c43cea831ac6c46dcebf12cfc9d4f1b8b86cc984cbb7b97febd60b3a18abbd34
Opcode Fuzzy Hash: 9506f20e7c06e9eb0a58547a959aa46dddf60b4aa5bf7b1f35dc1a76c50921f0
Instruction Fuzzy Hash: 4A41EA34A002149BCF10DF69C989A9F7BB1AF45318F1481BBE9147B3D2C7B99906CB99

Function 0040E7B9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,0040EA9E,00000022,FlsSetValue,00424C10,XLB,?,?,0040E34D,00000005,000000FF,?,0042265C,?,0000030C), ref: 0040E87A

Strings

api-ms-, xrefs: 0040E810
\&B, xrefs: 0040E7BB
ext-ms-, xrefs: 0040E824

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: FreeLibrary
String ID: \&B$api-ms-$ext-ms-
API String ID: 3664257935-2317152373
Opcode ID: 44f1290acfeacec479f1512a1ee3428897f646f830df81a029c49df3cb0b3ac6
Instruction ID: 4012b2fe006d2d0b67b012e3e8dd981d770bc36935733c9c5c7e598a419f1ddb
Opcode Fuzzy Hash: 44f1290acfeacec479f1512a1ee3428897f646f830df81a029c49df3cb0b3ac6
Instruction Fuzzy Hash: 8D212733B01210ABD731AB679C44A6B7768DB41764F244936E915B73D0D738ED22C6DC

Function 0040F57B Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0040F601

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: ed1ca1ad4da4a411609945542dd7c38cb34caad6b38a4c60ab76e69e4aa157ac
Instruction ID: dc49075dbe29aea34cc63941b5040ce46c986c10438abff2f63f6e317ee7565c
Opcode Fuzzy Hash: ed1ca1ad4da4a411609945542dd7c38cb34caad6b38a4c60ab76e69e4aa157ac
Instruction Fuzzy Hash: F0B13672900355AFDB218F64CC81BEA7BA5EF59310F148177E804BB7C2D379990AC7A9

Function 0040B6FC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,4D6935E9,?,?,00000000,00422884,000000FF,?,0040B6D8,?,?,0040B6AC,00000016), ref: 0040B731
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0040B743
FreeLibrary.KERNEL32(00000000,?,00000000,00422884,000000FF,?,0040B6D8,?,?,0040B6AC,00000016), ref: 0040B765

Strings

CorExitProcess, xrefs: 0040B73B
5iM, xrefs: 0040B711
mscoree.dll, xrefs: 0040B72A

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll$5iM
API String ID: 4061214504-2768375339
Opcode ID: 124f7ebd521d60b0e410297126f23d80573b62433cd3b559295fc29eac92d9cd
Instruction ID: 6370dcd61a2ed7012037e2dfb789d1b7c71b7b9fa6dca0720c73ba88a072e7bc
Opcode Fuzzy Hash: 124f7ebd521d60b0e410297126f23d80573b62433cd3b559295fc29eac92d9cd
Instruction Fuzzy Hash: 4901A731B00625EBCB219F54DC05FBFBBB8FB44B12F400636E811A22D0DB7C9900CA98

Function 0040A7C4 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(4D6935E9,00000000,00000000,?), ref: 0040A827

Part of subcall function 004105CB: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004169EF,?,00000000,-00000008), ref: 0041062C

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040AA79
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0040AABF
GetLastError.KERNEL32 ref: 0040AB62

Strings

5iM, xrefs: 0040A7DA

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID: 5iM
API String ID: 2112829910-3048065998
Opcode ID: 3a554ec306d3947c5cc2a8bf0770af2a863d12eeb22c93581bfa0be0d0b6811c
Instruction ID: f40b5385716ff4389f57edc1710acb458e6416b76c3ae8ca62fa6f7a360adb30
Opcode Fuzzy Hash: 3a554ec306d3947c5cc2a8bf0770af2a863d12eeb22c93581bfa0be0d0b6811c
Instruction Fuzzy Hash: 8CD18C71E002489FCF15CFA8C9809EEBBB5FF09314F28412AE556FB391D634A952CB59

Function 00416844 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 004169F9

Part of subcall function 0040EFD8: RtlAllocateHeap.NTDLL(00000000,00412419,?,?,00412419,00000220), ref: 0040F00A

__freea.LIBCMT ref: 00416A0C
__freea.LIBCMT ref: 00416A19

Strings

5iM, xrefs: 0041684B

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: __freea$AllocateHeap
String ID: 5iM
API String ID: 2243444508-3048065998
Opcode ID: cc367742ab360b17686459c72bb5173861b74c90bab6371e26f1a12c0115b94f
Instruction ID: ea7537065bb472dbdc035845ff1508112320e7b4e32fb60cef4c76f981497c6f
Opcode Fuzzy Hash: cc367742ab360b17686459c72bb5173861b74c90bab6371e26f1a12c0115b94f
Instruction Fuzzy Hash: 1D51D772600206AFEB209F65DC81EFB3AA9EF45754B16452EFC04F7241E738DC908A68

Function 00415E16 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,004107CC,00000000,00000001,00000000,?,?,0040ABB6,?,00000000,00000000), ref: 00415E2D
GetLastError.KERNEL32(?,004107CC,00000000,00000001,00000000,?,?,0040ABB6,?,00000000,00000000,?,?,?,0040B190,?), ref: 00415E39

Part of subcall function 00415DFF: CloseHandle.KERNEL32(FFFFFFFE,00415E49,?,004107CC,00000000,00000001,00000000,?,?,0040ABB6,?,00000000,00000000,?,?), ref: 00415E0F

___initconout.LIBCMT ref: 00415E49

Part of subcall function 00415DC1: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00415DF0,004107B9,?,?,0040ABB6,?,00000000,00000000,?), ref: 00415DD4

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,004107CC,00000000,00000001,00000000,?,?,0040ABB6,?,00000000,00000000,?), ref: 00415E5E

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: c1b31ca64fb6b4178efab5b29dc66f459a78b816e2564732be3b5a6236b1204f
Instruction ID: fa1ca2f8eedab9aa8d858d8fe393620cd5385d781bce9fad4cd398c5ec4f3b6b
Opcode Fuzzy Hash: c1b31ca64fb6b4178efab5b29dc66f459a78b816e2564732be3b5a6236b1204f
Instruction Fuzzy Hash: BAF01236A00614FBCF222FD5EC089CA3F66EB453B1F448025FA1895120C6359A61DF98

Function 0041B080 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 399COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 0041B1E5
__wsopen_s.LIBCMT ref: 0041B208

Strings

---*8+8*---, xrefs: 0041B298

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: __wsopen_s
String ID: ---*8+8*---
API String ID: 3347428461-2055049666
Opcode ID: c694cb92958b3e32395218d7ab3ece04d7ab59bf40b46bc7a60d691cd176eaa8
Instruction ID: 976c3b3f89cd006fc7855443565f672aa59bb482e59fd9afa8a16e51f1d88516
Opcode Fuzzy Hash: c694cb92958b3e32395218d7ab3ece04d7ab59bf40b46bc7a60d691cd176eaa8
Instruction Fuzzy Hash: 75E1A1B1D00208ABDF10DFA9CC45BDEB7B5FF58304F14416AE808B7291EB795A94CB99

Function 00412615 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041214C: GetOEMCP.KERNEL32(00000000), ref: 00412177

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,0041245C,?,00000000), ref: 00412676
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,0041245C,?,00000000), ref: 004126B2

Strings

5iM, xrefs: 0041261D

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: CodeInfoPageValid
String ID: 5iM
API String ID: 546120528-3048065998
Opcode ID: 725d5f4bfbcbbf24f0f5865bbe9f90d0454e1ad6d692831f8a197bf0f458913f
Instruction ID: b9531cb2c2331b738ea3cc25dfc4a8bd2fea530628bff8bab0a9e2d53f2fe125
Opcode Fuzzy Hash: 725d5f4bfbcbbf24f0f5865bbe9f90d0454e1ad6d692831f8a197bf0f458913f
Instruction Fuzzy Hash: FE512374A002459FDB21CF35CA806EBBBF5EF91304F18446FD096CB291D7B89996CB98

Function 0040AE34 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,00000000,?,00000000,0040B205,?,?,?,?,?,00000000,00000000,?,00404626,00000000), ref: 0040AF1D
GetLastError.KERNEL32(0040B205,?,?,?,?,?,00000000,00000000,?,00404626,00000000,00000000,00404563,?,00000000,?), ref: 0040AF4D

Strings

5iM, xrefs: 0040AE43

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: 5iM
API String ID: 442123175-3048065998
Opcode ID: 4626e5c990be0798fa7a71fb69b0762303116f67d85cbee5003ca92947302b47
Instruction ID: a0dbd6e7f538ed16d0434ea3decb72ecc31b21ecb44de96fbdef3d0f4160090f
Opcode Fuzzy Hash: 4626e5c990be0798fa7a71fb69b0762303116f67d85cbee5003ca92947302b47
Instruction Fuzzy Hash: 5831A871B00215AFDB24CF69DD81AEAB3B5EB44304F1440BAE605E7290D774ED918B69

Function 00412F69 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(?,-00000008,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00413033
__freea.LIBCMT ref: 00413040

Part of subcall function 0040EFD8: RtlAllocateHeap.NTDLL(00000000,00412419,?,?,00412419,00000220), ref: 0040F00A

Strings

5iM, xrefs: 00412F71

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: AllocateHeapStringType__freea
String ID: 5iM
API String ID: 4073780324-3048065998
Opcode ID: 66fdcdd8c0ec499f8cc7fb5d37a3fa264f99969675a13d552e6bf8e9a208fc13
Instruction ID: 2b31b3f8368c60d9d61f589e0ae1331ed412f356f759308ed58b533a5fbd8fb4
Opcode Fuzzy Hash: 66fdcdd8c0ec499f8cc7fb5d37a3fa264f99969675a13d552e6bf8e9a208fc13
Instruction Fuzzy Hash: E031C37290010AAFDB219F65CC41EEF7BA5EF08355F04002AF804A7252D638C991C798

Function 0040AD4B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,00000000,00000000,?,?,0040B1EE,?,?,?,?,?,00000000), ref: 0040ADF5
GetLastError.KERNEL32(?,0040B1EE,?,?,?,?,?,00000000,00000000,?,00404626,00000000,00000000,00404563,?,00000000), ref: 0040AE1B

Strings

5iM, xrefs: 0040AD5A

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: 5iM
API String ID: 442123175-3048065998
Opcode ID: da986ade33774c2c9855e48bd81446782f2e6f5175fd6b1de24497b5be994e49
Instruction ID: bd0e692b5365aec6773b9122b0f178aaec6df097d424a90e8b413bf9ee93a4ff
Opcode Fuzzy Hash: da986ade33774c2c9855e48bd81446782f2e6f5175fd6b1de24497b5be994e49
Instruction Fuzzy Hash: 65218531B002199FCB24CF19DD809DAB3B6FF89315B5444BAE909E7290D734DD91CBA9

Function 00401C8C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00401CCD
___raise_securityfailure.LIBCMT ref: 00401DB5

Strings

5iM, xrefs: 00401D96

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 5iM
API String ID: 3761405300-3048065998
Opcode ID: 3f911799a72d8de87942ea4974af6c40dd6a0a33284f8bf116b2d14b7d7bab69
Instruction ID: b803671686532ae34a0ad05f6aebb5f73deb965c2d87bd6bb2451cd76805f1b3
Opcode Fuzzy Hash: 3f911799a72d8de87942ea4974af6c40dd6a0a33284f8bf116b2d14b7d7bab69
Instruction Fuzzy Hash: 1821C4B9B44200DAD730CF15F9A5B54BFA4BB48314FA1403AE9089B7B0D7B4A582CF4D

Function 0040E884 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

Strings

\&B, xrefs: 0040E8C0
5iM, xrefs: 0040E898, 0040E8EB

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID:
String ID: \&B$5iM
API String ID: 0-3849078763
Opcode ID: cebf77624fd75bf1688dd2aada3b04bcb3cb3fe73f72bb60a5694c12ff81c2fb
Instruction ID: 9c0485bce1a3b81d9ad8012d6336cb4276aacab26641925ebcd4e2ea7070cc16
Opcode Fuzzy Hash: cebf77624fd75bf1688dd2aada3b04bcb3cb3fe73f72bb60a5694c12ff81c2fb
Instruction Fuzzy Hash: B801D6333002149FDB329FAEEC81A2B3365BBC13247654836F610B72D5DA3898229699

Function 00420F90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,bdNew: Failed to calloc memory.,BigDigits Error,00000010), ref: 00420F9A

Strings

bdNew: Failed to calloc memory., xrefs: 00420F97
BigDigits Error, xrefs: 00420F92

Memory Dump Source

Source File: 00000000.00000002.3947689128.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3947663281.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947720350.0000000000423000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947750826.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005E8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000005F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000607000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000615000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000061C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000663000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000665000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000668000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000066B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000685000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000687000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000068E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000695000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006B8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006BF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000006C2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000007CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008F7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000008FE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000902000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000905000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000908000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000090F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000913000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000916000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000919000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000091D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000920000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000924000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000927000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000092B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000932000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000935000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000939000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000093C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000940000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000943000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000098C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000099D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009B9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000009CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000A21000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000000EA8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000104E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001051000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001091000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001093000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001097000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000109A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000010FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001128000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000112F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001132000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000116E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001174000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001178000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000117F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001183000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001189000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000118E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001190000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001193000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000119F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011A5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011AC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011BD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011D8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011E6000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000011FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001206000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000120C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001210000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001213000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001217000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000121B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001221000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001226000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000122F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001232000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001239000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000123E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001244000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001247000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000124E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001252000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000136F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001373000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001376000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000137A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000014F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000155D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001567000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000156A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001571000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001578000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000157F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001586000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000158D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001594000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001597000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000015D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016AE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016B7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016D2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016F8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.00000000016FF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001825000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001827000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.000000000182E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3947769698.0000000001832000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_W4gFpExSht.jbxd

Similarity

API ID: Message
String ID: BigDigits Error$bdNew: Failed to calloc memory.
API String ID: 2030045667-3641427483
Opcode ID: 434bc77ba6a6f186945bf1346296b36a3148a215f97f5d21e1c7d844d57740c4
Instruction ID: 3705e236b079cd5f43ae3c73bdb5db9e5fe94445cfa140754d02e385798eebcf
Opcode Fuzzy Hash: 434bc77ba6a6f186945bf1346296b36a3148a215f97f5d21e1c7d844d57740c4
Instruction Fuzzy Hash: 10D0A7347813356AE73806609E07B273452AFF4702F59C43A7610585C2DAFD5840451C

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report W4gFpExSht.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\.curlrc.daenc

C:\Users\user\.ms-ad\DxxAlien_ReadMe.txt

C:\Users\user\3D Objects\DxxAlien_ReadMe.txt

C:\Users\user\3D Objects\desktop.ini.daenc

C:\Users\user\AppData\Local\.curlrc.daenc

C:\Users\user\AppData\Local\Adobe\ARM\Acrobat_23.006.20320\DxxAlien_ReadMe.txt

C:\Users\user\AppData\Local\Adobe\ARM\DxxAlien_ReadMe.txt

C:\Users\user\AppData\Local\Adobe\ARM\S\DxxAlien_ReadMe.txt

C:\Users\user\AppData\Local\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5}\DxxAlien_ReadMe.txt

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\CURRENT.daenc

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\DxxAlien_ReadMe.txt

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_0.daenc

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_1.daenc

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_2.daenc

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_3.daenc

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\index.daenc

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\DxxAlien_ReadMe.txt

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\DxxAlien_ReadMe.txt

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0.daenc

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0.daenc

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0.daenc

Windows Analysis Report
W4gFpExSht.exe